Raw logs format

[kathryn-garside]

Where can I find information on the format of the raw logs from each honeypot? i.e. Json fields and formats etc.

I am using the raw log files and not kibana/elastic search. In my current data some of the honeypots have not seen any activity so I do not have logs for them. But to automate the analysis of future logs I need the fields and what information I can expect to get back from the hpot.

I've looked through each honeypot git repo and can't find this information. Any help appreciated!

[Ganesh-403]

@kathryn-garside
Unfortunately, there isn't a single document that describes the raw log schema for every honeypot included in T-Pot.

Each honeypot is its own upstream project and defines its own log format, so the JSON fields are not standardized across T-Pot. T-Pot primarily collects those logs and normalizes them into Elasticsearch via Logstash—it doesn't introduce a common raw JSON schema. :contentReference[oaicite:0]{index=0}

The best sources of truth are therefore the individual honeypot projects. For example:

• Cowrie writes structured JSON to:

  var/log/cowrie/cowrie.json
  

  and its documentation describes the JSON logging output and related files. :contentReference[oaicite:1]{index=1}

• Dionaea supports a JSON logging handler (log_json), and its documentation covers exporting those events for ELK and other consumers. :contentReference[oaicite:2]{index=2}

For the remaining honeypots (Conpot, Heralding, Mailoney, etc.), you'll generally need to consult their respective repositories or inspect sample logs, as I couldn't find a central reference that documents every field for every honeypot.

If you're building an automated parser, I'd recommend a data-driven approach:

1. Collect a representative sample from each honeypot.
2. Infer the schema (field names and types) from the JSON.
3. Handle optional/missing fields gracefully, since not every event contains the same attributes.
4. Version your parsers, as upstream honeypots may add or rename fields over time.

If you're already using T-Pot, another useful reference is the Logstash pipeline itself. The filters show how T-Pot interprets and maps each honeypot's raw events into Elasticsearch, which can help identify important fields even if the upstream project doesn't explicitly document them. :contentReference[oaicite:3]{index=3}

One question:

• Are you looking for the native JSON schema of each honeypot, or are you trying to reproduce the normalized Elasticsearch fields that T-Pot creates after Logstash processing? The latter is much more consistent across honeypots.

If this solves your problem, feel free to mark it as the accepted answer so others can find it easily.