This repository has been archived by the owner on Apr 16, 2021. It is now read-only.

securityonion-elastic: avoid duplicating logs into multiple indices #1359

Closed

dougburks opened this issue Oct 30, 2018 · 3 comments

Contributor

dougburks commented Oct 30, 2018

OSSEC, firewall, and IDS logs are being duplicated into logstash-syslog indices.

Need to update /etc/logstash/conf.d/1001_preprocess_syslogng.conf to adjust tagging appropriately.

The text was updated successfully, but these errors were encountered:

Contributor Author

dougburks commented Oct 30, 2018

Security-Onion-Solutions/securityonion-elastic#33

Contributor Author

dougburks commented Nov 1, 2018

submitted for testing:
https://groups.google.com/d/topic/security-onion-testing/CDBWzS0OLU0/discussion

Contributor Author

dougburks commented Nov 12, 2018

published:
https://blog.securityonion.net/2018/11/elastic-642-and-updated-securityonion.html

dougburks closed this as completed

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.