PUT _template/<YOUR_TEMPLATE_NAME>
. In this repository we provide an index template that you can in your Elastic Stack/etc/logstash
with the appropriate data to your context. We Provide samples in this project:/home/USER/Offenses/
folder to save the extracted search data from QRadar in CSV.doc['@timestamp'].value.dayOfWeekEnum
doc['@timestamp'].value.hourOfDay
/home/elk/Offenses
notice here that I am storing my AQL search results in Offenses folder at elk
user's home folder.PS : Please see the index template definition to have basic understanding of the defined fields used in this project.
Example :1input {2file {3path => "/home/<USER>/<FOLDER NAME>/<FILENAME>.csv"4start_position => beginning5tags => "<MY_CLIENT>"6type => "OFFENSES"7}8}Copied!
Example :1output {2if [type] == "OFFENSES" {3elasticsearch {4hosts => ["https://localhost:9200"]5index => "soc-statistics-offenses-%{[client][name]}-%{+yyyy.MM}"6#manage_template => false7cacert => "/etc/logstash/root-ca.pem"8user => "<USERNAME>"9password => "<PASSWORD>"10ssl => true11ssl_certificate_verification => false12}13}14}Copied!