Instantly share code, notes, and snippets.

@Cyb3rWard0g Cyb3rWard0g/ksql_demo.yml
Last active Dec 18, 2018

Embed
What would you like to do?
# HELK KSQL Winlogbeat Config - Blog
# Author: Roberto Rodriguez (@Cyb3rWard0g)
# License: GPL-3.0
winlogbeat.event_logs:
- name: Microsoft-windows-sysmon/operational
ignore_older: 4h
#----------------------------- Kafka output --------------------------------
output.kafka:
# initial brokers for reading cluster metadata
hosts: ["192.168.64.138:9092"]
topic: "winlogbeat"
############################# HELK Optimizing Latency ######################
max_retries: 2
max_message_bytes: 1000000
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment