possible to include data from filebeat service?

[Dirk Westenhaus]

Hello,

do you think it is possible to have Wazuh accept, parse and index data cominig from a remote filebeat service?

With kind regards, Dirk

[victor....@wazuh.com]

Hello Dirk,

Yes, it is possible to enrich a Wazuh environment using your own data from a remote filebeat. Here's an overview of how you can do it:

1.  Data ingestion: Configure the Filebeat service to read the desired data, parse it, and send it to the Wazuh Indexer. You can create a new index specifically for your custom data or use an existing one.
   
2.  Wazuh Indexer: Once your data reaches the indexer, it will be stored in the specified index. Use proper mappings and templates for your data to ensure efficient handling by the Wazuh Indexer.
   
3.  Wazuh Dashboard: With your data stored in the Wazuh Indexer, you can use the Wazuh Dashboard to visualize and analyze it. Create custom visualizations and dashboards, and combine your data with Wazuh's data for a comprehensive view of your environment. To do this, create index patterns in the Wazuh Dashboard that correspond to your custom data indices.

If you need help, do not hesitate to detail your use case more; we will help you with the integration.

[Dirk Westenhaus]

Hi, thank you very much for the good news!

I have looked into Graylog and Filebeat, but am leaning very much towards liking Wazuh more. After trying to have an Exchange server's backend IIS logs ingested to Wazuh, I am a bit disappointed by Wazuh's capabilities as logcollector from logfiles (see my previous message about that here, if you want) . But If it is possible to re-use the filebeat configuration to send this logdata to Wazuh, it could be a best of both worlds.

Do I just specify the Wazuh manager as filebeat target?

And how would I configure a new index? I thought that index creation (and retention!) would be global. I'll be happy if this is not the case.

I did not have to create proper mappings and templates before, do you mean decoders?

Thank you for any hints.

With kind regards, Dirk.

[Dirk Westenhaus]

Sorry if these are a lot of newbie questions. I managed to send to a new index, but am stuck with discovering the data in Wazuh. I'll try to find my way in the documentation, but perhaps better return to the standard logcollector of the agent.

Thanks, Dirk.

[victor....@wazuh.com]

Hello Dirk,

I apologize for the delayed reply. After reviewing your use case, I suggest exploring alternative options instead of using Filebeat to collect all the IIS logs and ingest them in the manager

Since it appears to be a file limitation problem, I recommend trying the following workaround:

• Avoid monitoring files that no longer produce logs. This can be achieved by compressing or deleting old logs periodically, depending on your use case.
• Configure IIS Logging to consolidate IIS log directories and files, if possible.
• Specify the subdirectories individually instead of using wildcards, as you mentioned in your other message.

If these workarounds do not address the limitations you are facing, then we can consider using other tools for forwarding logs to the manager. If that is the case, let me know and we will consider other alternatives.