Non Real Time Logs Analising

[Francisco Navarro Hernández]

I am attempting to utilize Whazu, Elastic, and Kibana to analyze non-real-time logs. At the end of each month, I intend to import all the logs generated by various applications. These logs are in JSON format, and I use the JSON decoder, followed by a series of rules I have created. However, I encounter an issue where the logs have a date field that is created as a string when imported. This results in an inability to display the date correctly on a dashboard. Additionally, the timestamp that Whazu introduces reflects the moment of importation, rather than the indicated date. I have attempted to include the date at the beginning of the JSON object, and in the rule test, the date is detected and added to the timestamp. However, when I attempt to perform the same process with the actual file being analyzed by Whazu, there are no alerts generated as the date I input does not correspond with the current date. What steps could I take to address this issue?

[Nicolas Curioni]

Hello Francisco,

Thank you for sharing your doubts in the community.

In this case, it is needed to define the field as a date in the template.

The first step to achieve this is modifying the template. It is located at /etc/filebeat/wazuh-template.json.

Then, it is necessary to apply these changes. You can do this by running the following command:

# filebeat setup --index-management

You can see an example of how to modify this in the following blog entry: 

https://wazuh.com/blog/monitoring-windows-resources-with-performance-counters/

It is important to mention that if the field date is not in a supported format, it won't be indexed. Let me share with you some official documentation about this:

* https://www.elastic.co/guide/en/elasticsearch/reference/current/date.html

* https://opensearch.org/docs/2.4/opensearch/supported-field-types/date/

I hope this information would be useful for you.

Best regards.

On Tue, Mar 28, 2023 at 12:45 PM 'Francisco Navarro Hernández' via Wazuh mailing list <wa...@googlegroups.com> wrote:

I am attempting to utilize Whazu, Elastic, and Kibana to analyze non-real-time logs. At the end of each month, I intend to import all the logs generated by various applications. These logs are in JSON format, and I use the JSON decoder, followed by a series of rules I have created. However, I encounter an issue where the logs have a date field that is created as a string when imported. This results in an inability to display the date correctly on a dashboard. Additionally, the timestamp that Whazu introduces reflects the moment of importation, rather than the indicated date. I have attempted to include the date at the beginning of the JSON object, and in the rule test, the date is detected and added to the timestamp. However, when I attempt to perform the same process with the actual file being analyzed by Whazu, there are no alerts generated as the date I input does not correspond with the current date. What steps could I take to address this issue?

AVISO LEGAL: Este mensaje y sus archivos adjuntos van dirigidos exclusivamente a su destinatario, pudiendo contener información confidencial sometida a secreto profesional. No está permitida su comunicación, reproducción o distribución sin la autorización expresa de PAVASAL EMPRESA CONSTRUCTORA, S.A.. Si usted no es el destinatario final, por favor elimínelo e infórmenos por esta vía.

PROTECCIÓN DE DATOS: De conformidad con lo dispuesto en el Reglamento (UE) 2016/679 de 27 de abril (GDPR) y la Ley Orgánica 3/2018 de 5 de diciembre (LOPDGDD), le informamos que los datos personales y dirección de correo electrónico del interesado, serán tratados bajo la responsabilidad de PAVASAL EMPRESA CONSTRUCTORA, S.A. por un interés legítimo y para el envío de comunicaciones sobre nuestros productos y servicios y se conservarán mientras ninguna de las partes se oponga a ello. Los datos no serán comunicados a terceros, salvo obligación legal. Le informamos que puede ejercer los derechos de acceso, rectificación, portabilidad y supresión de sus datos y los de limitación y oposición a su tratamiento dirigiéndose a Avenida Tres Forques Nº149, - 46014 Valencia (Valencia). Email: d...@pavasal.com. Si considera que el tratamiento no se ajusta a la normativa vigente, podrá presentar una reclamación ante la autoridad de control en www.aepd.es.

Antes de imprimir este correo electrónico piense bien si es necesario hacerlo. 
El medio ambiente es cosa de todos.

--
You received this message because you are subscribed to the Google Groups "Wazuh mailing list" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+un...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/c4634951-39d4-4c81-b6a4-9becf3c92544n%40googlegroups.com.