Skip to content

Commit

Permalink
output-json: update timestamp format
Browse files Browse the repository at this point in the history
This patch updates the timestamp format used in eve loggin.
It uses a ISO 8601 comptatible string. This allow tools parsing
the output to easily detect adn/or use the timestamp.

In the EVE JSON output, the value of the timestamp key has been
changed to 'timestamp' (instead of 'time'). This allows tools
like Splunk to detect the timestamp and use it without configuration.

Logstash configuration is simple:

input {
   file {
      path => [ "/usr/local/var/log/suricata/eve.json" ]
      codec =>   json
      type => "suricata-log"
   }
}

filter {
   if [type] == "suricata-log" {
      date {
        match => [ "timestamp", "ISO8601" ]
      }
   }
}

In splunk, auto detection of the fle format is failling and it seems
you need to define a type to parse JSON in
$SPLUNK_DIR/etc/system/local/props.conf:

[suricata]
KV_MODE = json
NO_BINARY_CHECK = 1
TRUNCATE = 0

Then you can simply declare the log file in
$SPLUNK_DIR/etc/system/local/inputs.conf:

[monitor:///usr/local/var/log/suricata/eve.json]
sourcetype = suricata

In both cases the timestamp are correctly imported by
the tools.
  • Loading branch information
regit authored and victorjulien committed Mar 6, 2014
1 parent 1fa4233 commit 6c3c234
Show file tree
Hide file tree
Showing 4 changed files with 19 additions and 4 deletions.
4 changes: 2 additions & 2 deletions src/output-json-alert.c
Original file line number Diff line number Diff line change
Expand Up @@ -141,7 +141,7 @@ static int AlertJsonDecoderEvent(ThreadVars *tv, JsonAlertLogThread *aft, const

MemBufferReset(buffer);

CreateTimeString(&p->ts, timebuf, sizeof(timebuf));
CreateIsoTimeString(&p->ts, timebuf, sizeof(timebuf));

for (i = 0; i < p->alerts.cnt; i++) {
const PacketAlert *pa = &p->alerts.alerts[i];
Expand Down Expand Up @@ -169,7 +169,7 @@ static int AlertJsonDecoderEvent(ThreadVars *tv, JsonAlertLogThread *aft, const
}

/* time & tx */
json_object_set_new(js, "time", json_string(timebuf));
json_object_set_new(js, "timestamp", json_string(timebuf));

/* tuple */
//json_object_set_new(js, "srcip", json_string(srcip));
Expand Down
4 changes: 2 additions & 2 deletions src/output-json.c
Original file line number Diff line number Diff line change
Expand Up @@ -158,7 +158,7 @@ json_t *CreateJSONHeader(Packet *p, int direction_sensitive, char *event_type)
if (unlikely(js == NULL))
return NULL;

CreateTimeString(&p->ts, timebuf, sizeof(timebuf));
CreateIsoTimeString(&p->ts, timebuf, sizeof(timebuf));

srcip[0] = '\0';
dstip[0] = '\0';
Expand Down Expand Up @@ -204,7 +204,7 @@ json_t *CreateJSONHeader(Packet *p, int direction_sensitive, char *event_type)
}

/* time & tx */
json_object_set_new(js, "time", json_string(timebuf));
json_object_set_new(js, "timestamp", json_string(timebuf));

/* sensor id */
if (sensor_id >= 0)
Expand Down
14 changes: 14 additions & 0 deletions src/util-time.c
Original file line number Diff line number Diff line change
Expand Up @@ -35,6 +35,9 @@ static struct timeval current_time = { 0, 0 };
static SCSpinlock current_time_spinlock;
static char live = TRUE;


struct tm *SCLocalTime(time_t timep, struct tm *result);

void TimeInit(void)
{
SCSpinInit(&current_time_spinlock, 0);
Expand Down Expand Up @@ -120,6 +123,17 @@ void TimeSetIncrementTime(uint32_t tv_sec)
TimeSet(&tv);
}

void CreateIsoTimeString (const struct timeval *ts, char *str, size_t size)
{
time_t time = ts->tv_sec;
struct tm local_tm;
struct tm *t = (struct tm*)SCLocalTime(time, &local_tm);

snprintf(str, size, "%04d-%02d-%02dT%02d:%02d:%02d.%06u",
t->tm_year + 1900, t->tm_mon + 1, t->tm_mday, t->tm_hour,
t->tm_min, t->tm_sec, (uint32_t) ts->tv_usec);
}

/*
* Time Caching code
*/
Expand Down
1 change: 1 addition & 0 deletions src/util-time.h
Original file line number Diff line number Diff line change
Expand Up @@ -48,6 +48,7 @@ void TimeModeSetOffline (void);

struct tm *SCLocalTime(time_t timep, struct tm *result);
void CreateTimeString (const struct timeval *ts, char *str, size_t size);
void CreateIsoTimeString (const struct timeval *ts, char *str, size_t size);

#endif /* __UTIL_TIME_H__ */

0 comments on commit 6c3c234

Please sign in to comment.