diff --git a/docker/elk/logstash/dist/logstash.conf b/docker/elk/logstash/dist/logstash.conf index ae937fdf..3e356430 100644 --- a/docker/elk/logstash/dist/logstash.conf +++ b/docker/elk/logstash/dist/logstash.conf @@ -112,6 +112,13 @@ input { type => "Heralding" } +# Honeypots + file { + path => ["/data/honeypots/log/*.log"] + codec => json + type => "Honeypots" + } + # Honeypy file { path => ["/data/honeypy/log/json.log"] @@ -491,6 +498,13 @@ filter { } } +# Honeypots + if [type] == "Honeypots" { + date { + match => [ "timestamp", "ISO8601" ] + } + } + # Honeysap if [type] == "Honeysap" { date {