Skip to content

Instantly share code, notes, and snippets.

@Maddosaurus
Created November 5, 2019 19:53
Show Gist options
  • Save Maddosaurus/f347ed5c418b3d0f912346ba400c69b7 to your computer and use it in GitHub Desktop.
Save Maddosaurus/f347ed5c418b3d0f912346ba400c69b7 to your computer and use it in GitHub Desktop.
Cowrie Logstash config base
# This config assumes docker-elk as Elastic Stack base.
# See https://github.com/deviantony/docker-elk
version: '3'
services:
cowrie:
restart: "always"
image: cowrie/cowrie
ports:
- "2222:2222"
- "2223:2223"
volumes:
- "./cowrie-log:/cowrie/cowrie-git/var/log/cowrie"
#- ./cowrie-etc:/cowrie/cowrie-git/etc
filebeat:
image: docker.elastic.co/beats/filebeat:7.4.2
environment:
- setup.kibana.host=kibana:5601
- output.elasticsearch.hosts=["elasticsearch:9200"]
volumes:
- "./cowrie-log:/data/cowrie:ro"
- "./filebeat.docker.yml:/usr/share/filebeat/filebeat.yml:ro"
networks:
- docker-elk_elk
networks:
docker-elk_elk:
external: true
filebeat.inputs:
- type: log
paths:
- /data/cowrie/cowrie.json
json.keys_under_root: true
json.add_error_key: true
output.elasticsearch:
hosts: '${ELASTICSEARCH_HOSTS:elasticsearch:9200}'
username: 'elastic_username_here'
password: 'elastic_password_here'
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment