issue #9931 - [Filebeat] Add Zeek (formerly Bro) Module #10034
Conversation
…on to use an easier-to-diff format. Add Linux log file location to manifest.yml and use it as default
alakahakai
added
in progress
…ter clean up and redo, things should be fine.
|
Pinging @elastic/secops |
|
|
||
| ## Caveats | ||
|
|
||
| * Module is to be considered _alpha_. |
There was a problem hiding this comment.
We don't have a notion of Alpha in Elastic, we use either Beta or Experimental. Both Beta and Experimental are not recommended for production and our support team accepts Sev-3 issues only. The difference between them is that for Beta we have clear plans to move them to GA, while Experimental features might go away if unsuccessful. In this case, I'd say Beta fits best.
| ## Caveats | ||
|
|
||
| * Module is to be considered _alpha_. | ||
| * Field names will be changing for 7.0 to comply with Elastic Common Schema (ECS). |
There was a problem hiding this comment.
I think we'll only include this module in 7.0 anyway.
There was a problem hiding this comment.
Did not pay attention to this sentence. Will remove this.
| brew install bro | ||
| ``` | ||
|
|
||
| Configure it to process network traffic and generate logs. |
There was a problem hiding this comment.
I think this will look better as a list, i.e. start each line with *.
There was a problem hiding this comment.
Yes, I agree. Will update that
| * Module is to be considered _alpha_. | ||
| * Field names will be changing for 7.0 to comply with Elastic Common Schema (ECS). | ||
|
|
||
| ## How to try the module from source |
There was a problem hiding this comment.
Great tutorial, thanks for writing it! I think that after we have the module in a released version, we might want to switch to use the downloaded binaries, which should make it a bit easier.
There was a problem hiding this comment.
Maybe I can rename this to README-developer.md, and introduce a README.md for normal users that use binary distributions.
|
Is this beats-ci build error common? 09:00:01 testing_test.go:86: Failed to connect: dial tcp 127.0.0.1:43871: i/o timeout |
|
Jenkins, test this |
|
@alakahakai For now ignore the jenkins CI as it is broken currently. |
Fixes issue #9931, with support for Zeek/Bro conn.log, dns.log, http.log, files.log, and ssl.log