<html><head><style type='text/css'>p { margin: 0; }</style></head><body><div style='font-family: Verdana; font-size: 10pt; color: #000000'><font face="Verdana" size="2">AFAIK, ulogd</font><div><font face="Verdana" size="2">https://home.regit.org/2014/03/suricata-ulogd-splunk-logstash/</font></div><div><font face="Verdana" size="2"><br></font></div><div><font face="Verdana" size="2">can now output in json format, and then logstash or splunk can read them easily.</font></div><div><font face="Verdana" size="2"><br></font></div><div><font face="Verdana" size="2">code is here :</font></div><div><font face="Verdana" size="2">http://git.netfilter.org/ulogd2/tree/output/ulogd_output_JSON.c?id=2b39df550fbad944b4aab77617d4272c5d62ba70</font></div><div><font face="Verdana" size="2"><br></font><br>It could be wonderfull to add this kind of output format<br><div style="color: rgb(0, 0, 0); font-family: Verdana; font-size: 10pt;"><br class="Apple-interchange-newline"><table cellspacing="3" cellpadding="0" border="0" style="background-color: rgb(255, 255, 255); font-family: Calibri; height: 150px; "><tbody><tr><td class="style2"><p><span style="font-size: 12pt; "><img width="248" height="150" src="http://www.odiso.com/library/img/signature/logo_blanc.png" src="http://www.odiso.com/library/img/signature/logo_blanc.png"></span></p></td><td width="100%" class="style3" style="padding-left: 10px; "><table cellspacing="5" cellpadding="5" border="0" class="MsoNormalTable"><tbody><tr><td><p><b><span style="font-size: 12.5pt; "><font color="#198ea3">Alexandre </font></span></b><b><span style="font-size: 12.5pt; color: rgb(66, 66, 66); ">D</span></b><b style="font-size: 10pt; "><span style="font-size: 12.5pt; color: rgb(66, 66, 66); ">e</span></b><b style="font-size: 10pt; "><span style="font-size: 12.5pt; color: rgb(66, 66, 66); ">rumier</span></b><span style="font-size: 10pt; "> </span></p><p><b><span style="color: rgb(66, 66, 66); "><font size="2">Ingénieur Systèmes et Réseaux</font></span></b></p></td></tr><tr><td><p><font size="2"><b><span style="color: rgb(66, 66, 66); ">Fixe </span><span style="color: rgb(66, 66, 66); ">: </span></b><span style="color: rgb(99, 100, 102); ">03 20 68 88 90</span> <br> <br><b><span style="color: rgb(66, 66, 66); ">Fax : </span></b><span style="color: rgb(99, 100, 102); ">03 20 68 90 81</span></font></p></td></tr><tr><td class="style1"><p><font size="2"><span style="color: gray; ">45 Bvd du Général Leclerc 59100 Roubaix </span><br><span style="color: gray; ">12 rue Marivaux 75002 Paris</span></font><span style="font-size: 12pt; "></span></p></td></tr></tbody></table></td></tr></tbody></table><span style="font-family: Arial; background-color: rgb(255, 255, 255); "></span><br style="font-family: Arial; background-color: rgb(255, 255, 255); "><span name="x"></span><br></div><hr id="zwchr" style="color: rgb(0, 0, 0); font-family: Verdana; font-size: 10pt;"><div style="color: rgb(0, 0, 0); font-family: Helvetica, Arial, sans-serif; font-size: 12pt; font-weight: normal; font-style: normal; text-decoration: none;"><b>De: </b>"Dietmar Maurer" <dietmar@proxmox.com><br><b>À: </b>"Dietmar Maurer" <dietmar@proxmox.com>, "Eric Blevins" <eric@netwalk.com>, pve-devel@pve.proxmox.com<br><b>Envoyé: </b>Jeudi 13 Mars 2014 17:49:44<br><b>Objet: </b>Re: [pve-devel] pve-firewall: using NFLOG<br><br>> > logstash can read just about anything, it can also listen on UDP or<br>> > TCP and accept data in a format you specify.<br>> ><br>> <br>> So you think we can use whatever format we like?<br><br>And use nxlog to feed logstash?<br><br>_______________________________________________<br>pve-devel mailing list<br>pve-devel@pve.proxmox.com<br>http://pve.proxmox.com/cgi-bin/mailman/listinfo/pve-devel<br></div><br></div></div></body></html>