Skip to content

Instantly share code, notes, and snippets.

@tonymeehan

tonymeehan/gist:4996a0cb4f1eb3362c41076b1ba34a99

Last active February 27, 2020 14:51
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save tonymeehan/4996a0cb4f1eb3362c41076b1ba34a99 to your computer and use it in GitHub Desktop.
Save tonymeehan/4996a0cb4f1eb3362c41076b1ba34a99 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
gistfile1.txt
- type: log
enabled: true
paths:
- /var/log/crowdstrike/falconhoseclient/output
multiline.pattern: '^{'
multiline.negate: true
multiline.match: after
multiline.max_lines: 5000
multiline.timeout: 10
processors:
- decode_json_fields:
fields: ['message']
target: "crowdstrike"
process_array: true
max_depth: 8
- drop_fields:
fields: ['message']
output.elasticsearch:
pipeline: rename_model
@vi-or-die
Copy link

By default /var/log/crowdstrike/falconhoseclient/output does not have the .log extension.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment