search

robcowart / synesis_lite_suricata

Suricata IDS/IPS log analytics using the Elastic Stack.
Other
233 stars 92 forks source link

Logstash parsing error #25

Closed ngms17 closed 3 years ago

ngms17 commented 3 years ago
Screenshot 2020-12-01 at 15 54 14
robcowart commented 3 years ago

Can you please edit your issue to provide the actual log text instead of a screenshot? Also, please provide more details of your environment. Version of Suricata? Version of Elastic Stack? etc.

ngms17 commented 3 years ago

[2020-12-01T15:40:07,925][WARN ][logstash.outputs.elasticsearch][synlite_suricata][7f0f636925cafdc45ccbf6445a1562dacede6781ba4cf6f1b34e30bf21e877ba] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"suricata-1.1.0-2020.12.01", :routing=>nil, :_type=>"_doc"}, #], :response=>{"index"=>{"_index"=>"suricata-1.1.0-2020.12.01", "_type"=>"_doc", "_id"=>"PuD2HnYBONJZyV17Akbk", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse field [dns.grouped.SOA] of type [keyword] in document with id 'PuD2HnYBONJZyV17Akbk'. Preview of field's value: '{rname=hostmaster.inesctec.pt, serial=2020112712, expire=1209600, refresh=7200, mname=ns.inesctec.pt, minimum=21600, retry=3600}'", "caused_by"=>{"type"=>"illegal_state_exception", "reason"=>"Can't get text on a START_OBJECT at 1:1874"}}}}}

robcowart commented 3 years ago

You will probably need to modify your suricata configuration to send the old style of DNS log. This is done in suricata.yml under the eve-log -> types section. You need to use version 1. For example...

        - dns:
            enabled: yes
            version: 1
ngms17 commented 3 years ago

Unfortunatly it didn´t resolved the problem

robcowart commented 3 years ago

You will have to delete any indices that were already created. Also... what versions of Suricata and the Elastic Stack are you using?

ngms17 commented 3 years ago

All of the recent ones

robcowart commented 3 years ago

That could be part of the problem. This solution was created using Elastic Stack 7.1.x. It hasn't been test with any of the latest versions.

ngms17 commented 3 years ago

I will try that solution. If it does not work, i will have to downgrade. What version of suricata are you using?

Are you thinking of upgrading to newer versions?

robcowart commented 3 years ago

None at the moment actually. I think 4.x was current at the time this was created. I would have to spend some time to fully upgrade everything to support the latest releases. However, I won't realistically, be able to get to that until after the new year.