search

ComodoSecurity / openedr

Open EDR public repository
Other
2.19k stars 434 forks source link

Multiline json logs make filebeat->elasticsearch impossible #17

Closed johneiser closed 3 years ago

johneiser commented 3 years ago

I have filebeat picking up the logs from C:\\ProgramData\edrsvc\log\output_events\*.log and sending them to elasticsearch. However, I cannot parse the logs, as they are multiline json with no newline between (}{).

If we could make each log take up one line, or at least put a newline between json objects, that should make it possible for filebeat->elasticsearch to parse them.

johneiser commented 3 years ago

Ah, I see this was fixed and I was the third person to comment. Sorry! Great work.