jasonish · March 31, 2020 18:32
diff --git a/filebeat.yml b/filebeat.yml
 filebeat.inputs:
 - type: log
  enabled: true
  paths:
    - /var/log/suricata/eve.json

 output.logstash:
  hosts: ["10.16.1.10:5044"]
diff --git a/logstash.conf b/logstash.conf
 input {
  beats {
    port => 5044
    codec => "json"
  }
 }

 output {
  elasticsearch {
    hosts => "http://elasticsearch:9200"
    index => "logstash-alert-%{+YYYY.MM.dd}"
 }
 }
	input {
	beats {
	port => 5044
	codec => "json"
	}
	}

	output {
	elasticsearch {
	hosts => "http://elasticsearch:9200"
	index => "logstash-alert-%{+YYYY.MM.dd}"
	}
	}