I am trying to send suricata eve.json output to kafka
So I added a plugin for that foun don github
Now issue is that I am not getting any data in kafka . Topic is created , no error is shown when suricata runs . Also no data is written in eve.json that is present in logs folder which means it is sending data somewhere but it is known .
I am unable to find where those logs are going .
Anyone have worked with suricata and kafka can help in this.
Sharing a little of my suricata.yaml config
plugins: - /usr/local/lib/suricata/plugins/libkafka_output.so # Configure the type of alert (and other) logging you would like. outputs: # a line based alerts log similar to Snort's fast.log - fast: enabled: no filename: fast.log append: no #filetype: regular # 'regular', 'unix_stream' or 'unix_dgram' # Extensible Event Format (nicknamed EVE) event log in JSON format - eve-log: enabled: yes filetype: kafka #regular|syslog|unix_dgram|unix_stream|redis filename: eve.json kafka: brokers: "22.214.171.124:6667,126.96.36.199:6667,188.8.131.52:6667" topic: suricata client-id: suricata_client_01 buffer-size: 1024