Skip to content

Commit

Permalink
for supporting JSON logs from Zeek (idaholab#65); almost certainly br…
Browse files Browse the repository at this point in the history
…oken at this point
  • Loading branch information
mmguero committed Feb 16, 2024
1 parent 58f74b2 commit bf232c6
Show file tree
Hide file tree
Showing 6 changed files with 2,919 additions and 3,194 deletions.
9 changes: 1 addition & 8 deletions filebeat/scripts/filebeat-process-zeek-folder.sh
Original file line number Diff line number Diff line change
Expand Up @@ -18,8 +18,6 @@ LOCKDIR="/tmp/zeek-beats-process-folder"

export SCRIPT_DIR="$( cd -P "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"

export ZEEK_LOG_FIELD_BITMAP_SCRIPT="$SCRIPT_DIR/zeek-log-field-bitmap.py"

export ZEEK_LOG_AUTO_TAG=${AUTO_TAG:-"true"}

ZEEK_LOGS_DIR=${FILEBEAT_ZEEK_DIR:-/zeek/}
Expand Down Expand Up @@ -81,13 +79,8 @@ if mkdir $LOCKDIR; then
do
PROCESS_TIME=$(date +%s%N)
TAGS_JOINED=$(printf "%s," "${TAGS[@]}")${PROCESS_TIME}
FIELDS_BITMAP="$($ZEEK_LOG_FIELD_BITMAP_SCRIPT "$LOGFILE" | head -n 1)"
LINKNAME_BASE="$(basename "$LOGFILE" .log)"
if [[ -n $FIELDS_BITMAP ]]; then
LINKNAME="${LINKNAME_BASE}(${TAGS_JOINED},${FIELDS_BITMAP}).log"
else
LINKNAME="${LINKNAME_BASE}(${TAGS_JOINED}).log"
fi
LINKNAME="${LINKNAME_BASE}(${TAGS_JOINED}).log"
touch "$LOGFILE"
ln -sfr "$LOGFILE" "$LINKDIR/$LINKNAME"
done
Expand Down
160 changes: 0 additions & 160 deletions filebeat/scripts/zeek-log-field-bitmap.py

This file was deleted.

Loading

0 comments on commit bf232c6

Please sign in to comment.