topic Re: Syslog analyzer - how to configure logstash to send to remote, not local hosts ? in General Topics

Syslog analyzer - how to configure logstash to send to remote, not local hosts ?

niuk — Thu, 01 Dec 2016 14:54:21 GMT

I have syslog analyzer created from prototype stdlib.localSyslog. Now I want it to send matching results to logstash but on remote not local server where MM is running. Default is I think below (host is 127.0.0.1), where do I change host address ?

input {
    tcp {
        port => 5514
        host => '127.0.0.1'  
        codec => 'json_lines'
    }
}

Re: Syslog analyzer - how to configure logstash to send to remote, not local hosts ?

Rich_G — Thu, 01 Dec 2016 18:03:35 GMT

Looks like that configuraiton is under /opt/minemeld/prototypes/current/stdlib.yml

So I would think you could clone the prototype of stdlib.yml to the /opt/minemeld/local/prototypes and then modify as needed?

localSyslogToLogStash:
author: MineMeld Core Team
development_status: EXPERIMENTAL
node_type: processor
description: >
Syslog node connection to the local syslog server to receive PAN-OS logs.
This prototype also logs matching sessions/indicators pairs to a Logstash
instance on localhost:5514
class: minemeld.ft.syslog.SyslogMatcher
config:
logstash_host: 127.0.0.1
logstash_port: 5514

Re: Syslog analyzer - how to configure logstash to send to remote, not local hosts ?

Rich_G — Thu, 01 Dec 2016 18:07:36 GMT

Looking at this deeper looks like you can find the current prototype then create a new one from it and change the host.

Re: Syslog analyzer - how to configure logstash to send to remote, not local hosts ?

niuk — Thu, 01 Dec 2016 18:30:33 GMT

I've created it but I dont see COMMIT active and cannot commit.. So I dont see it as avail node yet

Re: Syslog analyzer - how to configure logstash to send to remote, not local hosts ?

Rich_G — Thu, 01 Dec 2016 18:40:00 GMT

I believe once you create the new prototype you then have to create a new Node that utilizes that prototype, then you can commit.

Re: Syslog analyzer - how to configure logstash to send to remote, not local hosts ?

Rich_G — Thu, 01 Dec 2016 18:45:35 GMT

Also once you have created the new prototype it will store the config in /opt/minemeld/local/prototypes so if you need to change the logstash host and port you can edit the minemeldlocal.yml file.

Re: Syslog analyzer - how to configure logstash to send to remote, not local hosts ?

niuk — Fri, 02 Dec 2016 15:22:14 GMT

Shouldn't my new prototype be visabl ein th elist of new prototypes (in CONFIG tab ) ? I can only find it when I click 'browes prototypes' icon. Before, when I created syslog_analyzer from stdlib.localSyslog it is available in CONFIG tab. I think something is not right..