Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

some cleanup and improvements of the zeek logstash pipeline #592

Closed
mmguero opened this issue Oct 11, 2024 · 0 comments
Closed

some cleanup and improvements of the zeek logstash pipeline #592

mmguero opened this issue Oct 11, 2024 · 0 comments
Assignees
Labels
code Issues for code cleanup/refactoring/technical debt logstash Relating to Malcolm's use of Logstash
Milestone

Comments

@mmguero
Copy link
Collaborator

mmguero commented Oct 11, 2024

I'm going to do a couple of things to make the zeek logstash pipeline cleaner and more maintainable:

  • Split the giant 11_zeek_parse.conf file up into an individual filter file for each log type
  • Automatically ensure that the Zeek TSV log parsing filters (dissect and split filters) in these files are looking for TAB characters (i.e., automatically replace spaces with tabs in these filter files in case the author forgot to do so)
@mmguero mmguero added logstash Relating to Malcolm's use of Logstash code Issues for code cleanup/refactoring/technical debt labels Oct 11, 2024
@mmguero mmguero added this to the v24.10.1 milestone Oct 11, 2024
@mmguero mmguero self-assigned this Oct 11, 2024
@mmguero mmguero added this to Malcolm Oct 11, 2024
@mmguero mmguero moved this to Testing in Malcolm Oct 11, 2024
mmguero added a commit to mmguero-dev/Malcolm that referenced this issue Oct 11, 2024
@mmguero mmguero closed this as completed Oct 14, 2024
@github-project-automation github-project-automation bot moved this from Testing to Done in Malcolm Oct 14, 2024
This was referenced Oct 23, 2024
@mmguero mmguero moved this from Done to Released in Malcolm Oct 24, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
code Issues for code cleanup/refactoring/technical debt logstash Relating to Malcolm's use of Logstash
Projects
Status: Released
Development

No branches or pull requests

1 participant