Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
BoWyatt
Participant

Log Exporter - Duplicated Logs [Logstash/Grafana]

Hello, I've setup up a log exporter sending logs to TCP on my logstash instance. The problem is I have all the log chain (since it's semi-unified mode) and since I'm using Grafana (doesn't have SIEM-like intelligence) I can't find a way to correlate the log chain (like 3 or more logs) to one single log. It is possible to aggregate this logs or make Checkpoint send the final log (with all the data updated) to my destination server?

3 Replies
PhoneBoy
Admin
Admin

Logs are sent every 10 minutes while the connection is open and one when the connection is closed.
I don’t believe you can change the behavior here, though could be wrong.

BoWyatt
Participant

I don't want to change that behaviour, it's fine for me. What I want to do is receive the unified log so I don't have "duplicates" in my ES server. Thank you

BoWyatt
Participant

I also noticed that there is not field for the event start and finish so I can't quite determinate when to stop or correlate the flow of logs. It will be good to have a solution not oritented to SIEM and more to other open source tools that doesn't have the SIEM intelligence to correlate the log flow.

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events