Possible to forward json logs to hyperledger-fabric

[killmasta93]

Hi
I was wondering if its possible to forward json logs to hyperledger-fabric or another open-source block chain?

Thank you

[Ganesh-403]

@killmasta93
Yes, it's possible, but not directly as a built-in T-Pot feature.

T-Pot stores honeypot events as JSON (and processes them through Logstash into Elasticsearch), so you can forward those events to virtually any downstream system—including Hyperledger Fabric or another permissioned blockchain—but you'll need an integration layer. T-Pot does not provide a native Hyperledger Fabric output plugin. (github.com)

A few common approaches are:

Option 1: Read the raw JSON logs (recommended)

Each honeypot writes persistent JSON logs under the T-Pot data directory, for example:

~/tpotce/data/cowrie/log/cowrie.json
~/tpotce/data/dionaea/log/
...

You can write a small application that:

1. Watches the JSON log files.
2. Extracts the fields you care about.
3. Submits them as transactions to your Hyperledger Fabric network using one of the Fabric SDKs or Gateway API.

This keeps T-Pot unchanged and avoids modifying its logging pipeline.

---

Option 2: Add another Logstash output

If you're already using Logstash, you can add an additional output so events are sent somewhere other than Elasticsearch.

For example:

output {
  elasticsearch {
    ...
  }

  # Your custom output
}

From there, your custom output could:

• send HTTP requests to a middleware service,
• publish to Kafka/RabbitMQ,
• or invoke another component that writes the events to Hyperledger Fabric.

Logstash is designed to support multiple outputs in a single pipeline. (elastic.co :contentReference[oaicite:0]{index=0})

---

Option 3: Middleware service (my recommendation)

Rather than having Logstash interact directly with Fabric, a cleaner architecture is:

T-Pot
   ↓
JSON / Logstash
   ↓
Middleware (Python / Go / Node.js)
   ↓
Hyperledger Fabric

The middleware can:

• validate events,
• remove duplicates,
• batch transactions,
• and invoke the appropriate chaincode.

This also keeps the blockchain logic separate from your logging infrastructure.

A consideration

One thing to think about is what you want to store on the blockchain.

Writing every raw honeypot event directly to Fabric may generate a very high transaction volume. In many cases it's more practical to store:

• hashes of the original logs,
• high-severity alerts,
• incident summaries,
• or other integrity-sensitive metadata,

while keeping the full JSON logs in Elasticsearch or another storage system. This provides tamper evidence without significantly increasing blockchain storage and transaction overhead.

One question that would help provide a more specific recommendation:

• Are you planning to store the entire JSON event on Hyperledger Fabric, or only a hash/verdict/metadata for integrity and audit purposes?

If this solves your problem, feel free to mark it as the accepted answer so others can find it easily.