# Shipping Suricata Logs from the Docker Container to Elastic SIEM **URL:** \ **Category:** Help\ **Created:** [August 19, 2020, 7:53pm UTC](https://forum.suricata.io/t/shipping-suricata-logs-from-the-docker-container-to-elastic-siem/523 "2020-08-19T19:53:30Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![austinsonger](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/austinsonger/32/1139_2.png) [@austinsonger](https://forum.suricata.io/u/austinsonger)\ **Post date:** [August 19, 2020, 7:53pm UTC](https://forum.suricata.io/t/shipping-suricata-logs-from-the-docker-container-to-elastic-siem/523/1 "2020-08-19T19:53:31Z")
Shipping Suricata Logs from the Docker Container to Elastic SIEM. I’ve deployed the suricata docker, but I don’t know how I would go about shipping thoses logs to Elastic SIEM. ---
**Author:** ![ish](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/ish/32/8_2.png) [@ish](https://forum.suricata.io/u/ish)\ **Post date:** [August 19, 2020, 8:00pm UTC](https://forum.suricata.io/t/shipping-suricata-logs-from-the-docker-container-to-elastic-siem/523/2 "2020-08-19T20:00:24Z")
Which Docker image do you use? It will depend partly on which Docker you used, but the process is much the same. You’ll likely need to export `/var/log/suricata` as a volume. For example: ```auto docker run -v /data/suricata/logs:/var/log/suricata ... ``` this will make /data/suricata/logs map to /var/log/suricata inside the container, so on the host you can now see the logs at /data/suricata/logs, which you can then point Logstash, Filebeat, or whatever at to send the logs somewhere. ---
**Author:** ![austinsonger](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/austinsonger/32/1139_2.png) [@austinsonger](https://forum.suricata.io/u/austinsonger)\ **Post date:** [August 19, 2020, 8:05pm UTC](https://forum.suricata.io/t/shipping-suricata-logs-from-the-docker-container-to-elastic-siem/523/3 "2020-08-19T20:05:45Z")
Using `jasonish/suricata:5.0.0` ---
**Author:** ![ish](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/ish/32/8_2.png) [@ish](https://forum.suricata.io/u/ish)\ **Post date:** [August 19, 2020, 8:14pm UTC](https://forum.suricata.io/t/shipping-suricata-logs-from-the-docker-container-to-elastic-siem/523/4 "2020-08-19T20:14:39Z")
Ok, thats my image. The above instructions about exposing the volume should work. ---
**Author:** ![austinsonger](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/austinsonger/32/1139_2.png) [@austinsonger](https://forum.suricata.io/u/austinsonger)\ **Post date:** [August 19, 2020, 9:23pm UTC](https://forum.suricata.io/t/shipping-suricata-logs-from-the-docker-container-to-elastic-siem/523/5 "2020-08-19T21:23:47Z")
Do I need to use the Elastic Filebeat docker container? [https://www.elastic.co/guide/en/beats/filebeat/current/running-on-docker.html](https://www.elastic.co/guide/en/beats/filebeat/current/running-on-docker.html) ---
**Author:** ![ish](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/ish/32/8_2.png) [@ish](https://forum.suricata.io/u/ish)\ **Post date:** [August 19, 2020, 9:49pm UTC](https://forum.suricata.io/t/shipping-suricata-logs-from-the-docker-container-to-elastic-siem/523/6 "2020-08-19T21:49:24Z")
There is no requirement that Filebeat be in a container… You could use the standalone distribution. I guess it depends on what you are trying to achieve. Unfortunately we don’t have any Suricata -\> Elasticsearch guides… There would also be a few variable on what you are trying to achieve that would tell you if you are better off using Filebeat, or Logstash, etc. In my opinion getting this all setup with containers, vs just installing a systems will complicate the matters, unless you are already comfortable with Docker volumes, docker-compose, etc. As its all really out of the scope of Suricata. ---
**Author:** ![austinsonger](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/austinsonger/32/1139_2.png) [@austinsonger](https://forum.suricata.io/u/austinsonger)\ **Post date:** [August 19, 2020, 10:02pm UTC](https://forum.suricata.io/t/shipping-suricata-logs-from-the-docker-container-to-elastic-siem/523/7 "2020-08-19T22:02:54Z")
**Use Case:** - Testing SIEM Products (1) Elastic SIEM (2) Azure Sentinel - Trying to see the amount of quality data that is generated among each of the SIEM tools. **Elastic SIEM Environment** 1. Blue VM (Victim Machine) - With Suricata 2. Red VM (Attack Machine) - Created a script that will send different types of attacks every 15 minutes to the Blue VM. This will occur over a period of 2 days. - Want the blue machine to send the Suricata data back to the Elastic SIEM **Azure Sentinel Environment** 1. Blue VM (Victim Machine) - With Suricata 2. Red VM (Attack Machine) - Created a script that will send different types of attacks every 15 minutes to the Blue VM. This will occur over a period of 2 days. - Want the blue machine to send the Suricata data back to the Azure Sentinel SIEM ---
**Author:** ![ish](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/ish/32/8_2.png) [@ish](https://forum.suricata.io/u/ish)\ **Post date:** [August 19, 2020, 11:05pm UTC](https://forum.suricata.io/t/shipping-suricata-logs-from-the-docker-container-to-elastic-siem/523/8 "2020-08-19T23:05:58Z")
I’m not too familar with SIEMs, but I do know that the Elastic SIEM requires Suricata events to be in ECS format. For that you would use the Suricata module for Filebeat. [https://www.elastic.co/guide/en/beats/filebeat/7.9/filebeat-module-suricata.html](https://www.elastic.co/guide/en/beats/filebeat/7.9/filebeat-module-suricata.html) Note that we (Suricata) have no involvement with this, and I don’t use it myself.