Suricata通过filebeat将告警事件送往Kafka,ElasticSearch

Suricata可以通过logstash将告警事件送往Kafka,ElasticSearch,其实filebeat也可以用来代替logstash,更轻量级，消耗更低性能
配置文件filebeat.yml

filebeat.inputs:
- type: log
  enabled: true
  paths:
    - /suricatalog/eve.json
  #json.keys_under_root: true #解析json，将json中的字段都放到根节点
  #json.overwrite_keys: true  #配合上一条使用，如果解析出来的字段名和跟节点的字段名相同则覆盖
output.kafka:
  # initial brokers for reading cluster metadata
  hosts: ["10.42.107.170:9092"]
  # message topic selection + partitioning
  topic: 'alert'
  partition.round_robin:
    reachable_only: false

  required_acks: 1
  compression: gzip
  max_message_bytes: 1000000

启动filebeat
./filebeat -e