search

aws-samples / siem-on-amazon-opensearch-service

A solution for collecting, correlating and visualizing multiple types of logs to help investigate security incidents.
MIT No Attribution
567 stars 184 forks source link

Ingesting Custom Logs #388

Closed bhenry999 closed 1 year ago

bhenry999 commented 1 year ago

We attempted to manually export some custom app logs from CW into the created S3 bucket, but those logs are not being ingested, or at least not visible, in OpenSearch dashboard. Can you please advise what we may be doing wrong and how to resolve the issue?

We have attempted to ingest the logs into the top-level (no prefix), and within the opensearch prefix. Not sure if what affect prefixes have on the rest of the workflow, but tried different options anyway.

"Regular" CW logs from native AWS services seem to work just fine.

nakajiak commented 1 year ago

Hello, you can check the logs in your SIEM dashboard on CloudWatch Dashboard. Are there any errors or something? And can you share your user.ini?

bhenry999 commented 1 year ago

Issue on our end. Thank you.