blason
(Blason)
September 19, 2018, 7:44am
1
Hi Graylog Team,
I need to use what called Dictionary feature in logstash for looking up a yaml file or CSV file and if match is found add new field in logs.
E.g.
“xyz.com ”: “PHISHING”
“bad.com ”: “APT”
“qaz.com ”: “CVE-1234-1234”
and so on
Now my confusion is which method should I use to achieve the above stuff? I even need to create a dashboard and Alert notifications basis on those fields and decorators what I understood is - can not be used in Dashboards.
Hence can someone please suggest?
Hi
You need the lookup feature of graylog.
First you need to config lookup, after set an extractor or pipeline to use it.
http://docs.graylog.org/en/2.4/pages/lookuptables.html
https://community.graylog.org/t/using-a-csv-lookup-table-within-a-pipeline/3707
//Decorators are only available in search and work in real time, so you can’t use it in alert and dashboard
1 Like
system
(system)
Closed
October 3, 2018, 8:52am
3
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.