This repository has been archived by the owner on Apr 16, 2021. It is now read-only.
-
Notifications
You must be signed in to change notification settings - Fork 521
CustomELSAParsers
doug edited this page Aug 27, 2019
·
8 revisions
Please note! This wiki is no longer maintained. Our documentation has moved to https://securityonion.net/docs/. Please update your bookmarks. You can find the latest version of this page at: https://securityonion.net/docs/CustomELSAParsers.
https://github.com/mcholste/elsa/wiki/Documentation#AddingParsers
Create a new subdirectory in /etc/elsa/patterns.d/
, add your parsers to the new subdirectory, and then use pdbtool
to merge the entire /etc/elsa/patterns.d/
directory into /opt/elsa/node/conf/patterndb.xml
. For example:
# Create a new subdirectory in /etc/elsa/patterns.d/
sudo mkdir /etc/elsa/patterns.d/local/
# Add new parser
sudo nano /etc/elsa/patterns.d/local/my_new_log_parser
# Test new parser
pdbtool test /etc/elsa/patterns.d/local/my_new_log_parser
# Backup existing patterndb.xml
sudo cp /opt/elsa/node/conf/patterndb.xml /opt/elsa/node/conf/patterndb.xml.bak
# Merge all patterns into new patterndb.xml
sudo pdbtool merge -p /opt/elsa/node/conf/patterndb.xml --recursive -D /etc/elsa/patterns.d/
# Restart syslog-ng
sudo service syslog-ng restart
https://groups.google.com/forum/#!topic/enterprise-log-search-and-archive/SJwOY7N2A60
- Introduction
- Use Cases
- Hardware Requirements
- Release Notes
- Download/Install
- Booting Issues
- After Installation
- UTC and Time Zones
- Services
- VirtualBox Walkthrough
- VMWare Walkthrough
- Videos
- Architecture
- Cheat Sheet
- Conference
- Elastic Stack
- Elastic Architecture
- Elasticsearch
- Logstash
- Kibana
- ElastAlert
- Curator
- FreqServer
- DomainStats
- Docker
- Redis
- Data Fields
- Beats
- Pre-Releases
- ELSA to Elastic
- Network Configuration
- Proxy Configuration
- Firewall/Hardening
- Email Configuration
- Integrating with other systems
- Changing IP Addresses
- NTP
- Managing Alerts
- Managing Rules
- Adding Local Rules
- Disabling Processes
- Filtering with BPF
- Adjusting PF_RING for traffic
- MySQL Tuning
- Adding a new disk
- High Performance Tuning
- Trimming PCAPs