How Zeek integration to opensearch

OpenSearch
1

Versions (relevant - OpenSearch/Dashboard/Server OS/Browser):

Hello, I am using OpenSearch version 3.1.

Describe the issue:

I want to send Zeek logs to Opensearch but I haven’t been able to find a suitable tool yet. I used Fluent-bit before but it wasn’t very useful for me. What other tools do you recommend? I also used Filebeat oss but I gave up on using it because the zeek model wasn’t available in this version and it wasn’t very compatible with opensearch.

Configuration:

Relevant Logs or Screenshots:

2

@taha Great question, The most straight forward approach can be to configure Zeek to produce json logs (using option LogAscii::use_json=T), you can then simply use Data Prepper file source, using something like the following:

zeek-json:
  source:
    file:
      path: /zeek/logs/conn.log
  sink:
    - opensearch:
        hosts: ["https://opensearch:9200"]
        username: admin
        password: "..."
        insecure: true
        index: zeek-logs-{{yyyy.MM.dd}}

You can fo course apply additional processing to the logs using Data Prepper processors

Hope this helps

1 Like