Suricata通过logstash将告警事件送往Kafka

一.安装logstash,解压即可使用
环境装有jdk1.8
tar -zxvf logstash-6.5.4.tar.gz

二.自己创建logstash运行配置文件
比如创建:config/logstash.conf(记得使用的时候把注释删掉)

input
{
	file 
	{
    	path => ["/usr/local/var/log/suricata/eve.json"]//Suricata告警事件文件路径
    	codec =>  "json"
    	type => "SuricataAlert"
	}
}
output
{
	kafka
	{
		codec => json	//kafka接收的value格式
        topic_id => "logstash_topic" //创建的主题
        bootstrap_servers => "localhost:9092" //Kafka broker
    }
}

三.启动logstash
bin/logstash -f config/logstash.conf

四.在Kafka消费者中查看结果
tppic=logstash_topic,partition=15,offset=49106, key=null, value ={“dest_ip”:“192.43.132.10”,“proto”:“UDP”,“flow_id”:257182625510482,“src_ip”:“187.42.154.207”,“dns”:{“rrtype”:“A”,“type”:“query”,“id”:38567,“tx_id”:0,“rrname”:“clients1.google.com”},“host”:“localhost.localdomain”,“in_iface”:“eth2”,“event_type”:“dns”,"@timestamp":“2019-01-10T08:15:05.779Z”,“type”:“SuricataAlert”,“path”:"/usr/local/var/log/suricata/eve.json",“src_port”:60679,“timestamp”:“2019-01-10T16:15:05.734290+0800”,"@version":“1”,“dest_port”:53}