jeffgeiger / brostash Goto Github PK

Howdy!

I was helping someone with bro/logstash stuff and I found brostash. This is a great idea!

I saw it outputs grok filters with tab separations, but the csv filter is super nice for this kind of data:

Example fields input:

capture_loss.log:#fields    ts  ts_delta    peer    gaps    acks    percent_lost

Possible logstash filter config:

filter {
  csv {
    columns => ["ts", "ts_delta", "peer", "gapsacks", "percent_lost"]
    separator => "\t"
  }
}

Should work? Also should be more readable than the grok patterns.

Any thoughts? :)