search

philhagen / sof-elk

Configuration files for the SOF-ELK VM
GNU General Public License v3.0
1.46k stars 272 forks source link

update filebeat inputs to use filestream #295

Closed philhagen closed 7 months ago

philhagen commented 8 months ago

currently inputs use - type: log. we should be using - type: filestream

see https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-filestream.html

philhagen commented 8 months ago

this should be all set in 08e4f3540cf79c131230646ff0d43a63a2bf7233. I tested enough data types to feel confident that the conversion will cover all of our use cases, but will keep this issue open until it's released with a new VM. (Too touchy to release to existing VMs, as it could result in data loss and/or duplication.)

to test this now, use a FRESH vm with no evidence loaded, then update per the wiki instructions on develop

philhagen commented 7 months ago

extensively validated in development