Suricata and Elasticsearch Integration

<pre><code class="language-toml">[[inputs.suricata]] ## Source ## Data sink for Suricata stats log. This is expected to be a filename of a ## unix socket to be created for listening. # source = "/var/run/suricata-stats.sock" ## Delimiter ## Used for flattening field keys, e.g. subitem "alert" of "detect" becomes ## "detect_alert" when delimiter is "_". # delimiter = "_" ## Metric version ## Version 1 only collects stats and optionally will look for alerts if ## the configuration setting alerts is set to true. ## Version 2 parses any event type message by default and produced metrics ## under a single metric name using a tag to differentiate between event ## types. The timestamp for the message is applied to the generated metric. ## Additional tags and fields are included as well. # version = "1" ## Alerts ## In metric version 1, only status is captured by default, alerts must be ## turned on with this configuration option. This option does not apply for ## metric version 2. # alerts = false </code></pre>

<pre><code class="language-toml"> [[outputs.elasticsearch]] ## The full HTTP endpoint URL for your Elasticsearch instance ## Multiple urls can be specified as part of the same cluster, ## this means that only ONE of the urls will be written to each interval urls = [ "http://node1.es.example.com:9200" ] # required. ## Elasticsearch client timeout, defaults to "5s" if not set. timeout = "5s" ## Set to true to ask Elasticsearch a list of all cluster nodes, ## thus it is not necessary to list all nodes in the urls config option enable_sniffer = false ## Set to true to enable gzip compression enable_gzip = false ## Set the interval to check if the Elasticsearch nodes are available ## Setting to "0s" will disable the health check (not recommended in production) health_check_interval = "10s" ## Set the timeout for periodic health checks. # health_check_timeout = "1s" ## HTTP basic authentication details. ## HTTP basic authentication details # username = "telegraf" # password = "mypassword" ## HTTP bearer token authentication details # auth_bearer_token = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9" ## Index Config ## The target index for metrics (Elasticsearch will create if it not exists). ## You can use the date specifiers below to create indexes per time frame. ## The metric timestamp will be used to decide the destination index name # %Y - year (2016) # %y - last two digits of year (00..99) # %m - month (01..12) # %d - day of month (e.g., 01) # %H - hour (00..23) # %V - week of the year (ISO week) (01..53) ## Additionally, you can specify a tag name using the notation {{tag_name}} ## which will be used as part of the index name. If the tag does not exist, ## the default tag value will be used. # index_name = "telegraf-{{host}}-%Y.%m.%d" # default_tag_value = "none" index_name = "telegraf-%Y.%m.%d" # required. ## Optional Index Config ## Set to true if Telegraf should use the "create" OpType while indexing # use_optype_create = false ## Optional TLS Config # tls_ca = "/etc/telegraf/ca.pem" # tls_cert = "/etc/telegraf/cert.pem" # tls_key = "/etc/telegraf/key.pem" ## Use TLS but skip chain &amp; host verification # insecure_skip_verify = false ## Template Config ## Set to true if you want telegraf to manage its index template. ## If enabled it will create a recommended index template for telegraf indexes manage_template = true ## The template name used for telegraf indexes template_name = "telegraf" ## Set to true if you want telegraf to overwrite an existing template overwrite_template = false ## If set to true a unique ID hash will be sent as sha256(concat(timestamp,measurement,series-hash)) string ## it will enable data resend and update metric points avoiding duplicated metrics with different id's force_document_id = false ## Specifies the handling of NaN and Inf values. ## This option can have the following values: ## none -- do not modify field-values (default); will produce an error if NaNs or infs are encountered ## drop -- drop fields containing NaNs or infs ## replace -- replace with the value in "float_replacement_value" (default: 0.0) ## NaNs and inf will be replaced with the given number, -inf with the negative of that number # float_handling = "none" # float_replacement_value = 0.0 ## Pipeline Config ## To use a ingest pipeline, set this to the name of the pipeline you want to use. # use_pipeline = "my_pipeline" ## Additionally, you can specify a tag name using the notation {{tag_name}} ## which will be used as part of the pipeline name. If the tag does not exist, ## the default pipeline will be used as the pipeline. If no default pipeline is set, ## no pipeline is used for the metric. # use_pipeline = "{{es_pipeline}}" # default_pipeline = "my_pipeline" # # Custom HTTP headers # To pass custom HTTP headers please define it in a given below section # [outputs.elasticsearch.headers] # "X-Custom-Header" = "custom-value" ## Template Index Settings ## Overrides the template settings.index section with any provided options. ## Defaults provided here in the config # template_index_settings = { # refresh_interval = "10s", # mapping.total_fields.limit = 5000, # auto_expand_replicas = "0-1", # codec = "best_compression" # } </code></pre>