Is it possible to send suricata logs to graylog?
The short answer is Yes, crafting appropriate FileBeat configuration for EVE and Alerts works for me at least.
Directly from filebeat to graylog? Without passing to logstash?
My humble understanding is that FileBeat is an alternative for LogStash, so yes, FileBeat logs directly to Graylog. Check for FileBeat Input in Graylog. FileBeat has the option to parse JSON for EVE.log and it is possible to custom multilie events like Java logs or Suricata alerts.
I also just send fast.log using rsyslog.
We run fluentd on the suricata node with its Graylog Extended Log Format(GELF) plugin and then fluentd is configured to sent to graylog on its configured input settings.
#### ## Output descriptions: ## # @see http://docs.fluentd.org/articles/http-to-td # @see https://docs.fluentd.org/configuration/buffer-section ## Graylog <match your.ids.node.tag> @type gelf host your.graylog.server (can also be ip address) port port (matches what is configured on graylog input) protocol udp or tcp (should match your input type on graylog) slow_flush_log_threshold 20.0 <buffer> @type file path /var/log/td-agent/buffer/suricata-fluentd-buffer chunk_limit_size 256MB total_limit_size 64GB flush_mode interval flush_interval 60s flush_thread_count 10 overflow_action block </buffer> </match> #### ## Source descriptions: ## ## Suricata ## read suricata eve.log continuously <source> @type tail <parse> @type json </parse> path /var/log/suricata/eve.json pos_file /var/log/td-agent/suricata-eve.log.pos tag your-ids-node-tag </source>
I have a buffer added here just from production use and you will probably have to adjust the memory and space settings to your needs/system. So far this seems to work out pretty well and with the buffer enabled I can update the graylog stack and alerts will queue on the suricata node then get processed when the graylog input availability resumes.
Last note is that the application is named fluentd but the program is td-agent. To install the plugin make sure to use the td-agent ruby updater instead of the system ruby as the system ruby is not recognized.