PUT _template/<YOUR_TEMPLATE_NAME>
. In this repository we provide an index template that you can in your Elastic Stack/etc/logstash
with the appropriate data to your context. We Provide samples in this project:/home/USER/Offenses/
folder to save the extracted search data from QRadar in CSV.doc['@timestamp'].value.dayOfWeekEnum
doc['@timestamp'].value.hourOfDay
/home/elk/Offenses
notice here that I am storing my AQL search results in Offenses folder at elk
user's home folder.PS : Please see the index template definition to have basic understanding of the defined fields used in this project.
Example :input {file {path => "/home/<USER>/<FOLDER NAME>/<FILENAME>.csv"start_position => beginningtags => "<MY_CLIENT>"type => "OFFENSES"}}
Example :output {if [type] == "OFFENSES" {elasticsearch {hosts => ["https://localhost:9200"]index => "soc-statistics-offenses-%{[client][name]}-%{+yyyy.MM}"#manage_template => falsecacert => "/etc/logstash/root-ca.pem"user => "<USERNAME>"password => "<PASSWORD>"ssl => truessl_certificate_verification => false}}}