I want to send packet data using logstash

Help
, ,
1

i want to send suricata log with packet data to elk.
eve.json is easy to send for elk using filebeat or logstash but I want to include packet data in detection event and send it to elk.

in sguil, can analysis packet data in Detection event.
I want to check like that in elk.

I only need to be able to check the hexstream(packet) of Detection Event in kibana.

is it possible?

2

We don’t provide this in hex at this time, but do so in base64, or the printable bytes. In your suricata.yaml look at outputs.eve-log.types.alert.payload and set that to yes as its off by default.

1 Like