search

cleesmith / unifiedbeat

Unifiedbeat reads records from Unified2 binary files generated by network intrusion detection software and indexes the records in Elasticsearch.
MIT License
30 stars 14 forks source link

Updated for Elastic 6.0 #14

Closed cailen closed 6 years ago

cailen commented 6 years ago

First off - love this beat.

I have been trying for about two weeks to understand how this beat works and to try to rework it to work with Beats 6.0 so it will work with Elastic 6.0. If someone could point me in the right direction, I'd be more than happy to try to get this working for Elastic 6. Right now this does not work at all and is completely broken due to them reworking how beats send bulk data, etc.

ruflin commented 6 years ago

@cailen As you have pointed out, lots of things have happened on the beats side since the creation of this beat. One major thing that changed is that now prospectors are more pluggable and hopefully are even more in the future. Initially when this beat was created we discussed if it could be a prospector type but it need too many hacks. I wonder if bringing this beat to 6.x would be best to convert it to a prospector type and use filebeat as a framework. Perhaps long term it could even be part of filebeat?

For some guidance on how prospectors work, have a look at https://github.com/elastic/beats/tree/master/filebeat/prospector and the existing prospectors inside. Ping me if you need some more pointers.