Giter Site home page Giter Site logo

sof-elk's Introduction

sof-elk

alt tag

This repository contains the configuration and support files for the SANS FOR572 Logstash VM Appliance. More details about the pre-packaged VM are available here: http://for572.com/logstash-readme.

Branches:

  • master: This branch is considered suitable for widespread use, but should not be used in the FOR572 class itself. The classroom labs are version-locked, but work on this repository is ongoing.
  • develop: This branch contains code that should be functional, but may break at times (and remain broken). Of course, we'll try to avoid that, but it should be clear that this is NOT a branch suitable for "real world" use.
  • feature/*: Branches where new code functionality is tested before being merged into develop.
  • hotfix/*: Branches where quick-term fixes are tested before being merged into develop and immediately to master.
  • release/*: Branches where code in the develop branch is prepared for release to a VM build via a merge to master.
  • Other branches may be used for major version updates, etc. These will be merged to master when deployed for mainstream use.

Tags:

When a VM is prepared for distribution in the SANS FOR572 course, the revision will be tagged with a corresponding date-based version (e.g. "2014-12-18"). Users may want to consider updating to the contents of the "master" branch, but at times, this branch will expect updates to the Logstash VM itself. Release notes on the github page (located at http://for572.com/sof-elk-git) will alert users when such system-level changes are required.

Using:

The various configuration files expect some of these files to reside at a specific path on the filesystem. For this reason, we recommend you clone the git repository to /usr/local/sof-elk/. To use these configuration files, I recommend symlinking them into $LS_CONF_DIR as defined by your configuration file.

Contents by directory:

  • /dashboards/: These files define the Kibana dashboards for individual data types. These correspond with the parsing completed by the Logstash files in the /configfiles/ directory, so they probably won't work on your own Logstash instance without some tweaking. Note that with Kibana 4, dashboards are only kept in the Elastic database, so to load these to the interface, run the /dashboards/load_all_dashboards.sh script.
  • /configfiles/: These files conatain parsing/tagging/formatting/etc logic for individual file types as well as output configuration.
  • /grok-patterns/: Custom parsing patterns used by the files in the /configfiles/ directory.
  • /lib/: Supporting files, including elasticsearch mappings, YAML lookup files, and images.

Questions/Bug Reports/etc:

All bugs and feature requests should be logged via the github issue tracker: https://github.com/philhagen/sof-elk/issues/.

sof-elk's People

Contributors

philhagen avatar

Watchers

CrazyKID avatar

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.