processors: - timestamp: field: timestamp layouts: - '2006-01-02 15:04:05'{ "@timestamp": "2024-04-12T15:37:52.000Z",
"@metadata": {
"beat": "filebeat",
"type": "_doc",
"version": "8.13.0"
},
"protocol": "UDP",
"sport": 60101,
"timestamp": "2024-04-12 15:37:52",
"sip": "192.168.56.1",
"path": "SEND",
"dip": "239.255.255.250",
"message": "2024-04-12 15:37:52 ALLOW UDP 192.168.56.1 239.255.255.250 60101 1900 0 - - - - - - - SEND",
"dport": 1900,
"action": "ALLOW"
}
{
"@timestamp": "2024-04-12T15:37:52.000Z",
"@metadata": {
"beat": "filebeat",
"type": "_doc",
"version": "8.13.0"
},
"sip": "192.168.31.177",
"sport": 60102,
"dport": 1900,
"protocol": "UDP",
"path": "SEND",
"message": "2024-04-12 15:37:52 ALLOW UDP 192.168.31.177 239.255.255.250 60102 1900 0 - - - - - - - SEND",
"timestamp": "2024-04-12 15:37:52",
"dip": "239.255.255.250",
"action": "ALLOW"
}
{
"@timestamp": "2024-04-12T15:37:52.000Z",
"@metadata": {
"beat": "filebeat",
"type": "_doc",
"version": "8.13.0"
},
"protocol": "UDP",
"sip": "172.21.160.1",
"dip": "239.255.255.250",
"dport": 1900,
"path": "SEND",
"message": "2024-04-12 15:37:52 ALLOW UDP 172.21.160.1 239.255.255.250 60103 1900 0 - - - - - - - SEND",
"action": "ALLOW",
"sport": 60103,
"timestamp": "2024-04-12 15:37:52"
}테스트할 땐 문제 없어 보였는데 인덱싱을 하고 나니 데이터가 보이지 않는다.
검색 시간을 바꿔보니 오늘자 데이터가 내일 검색됨. beat가 보내준 시간 정보를 키바나가 GMT로 인식하나봄(..)
설정 변경.
processors: - timestamp: field: timestamp layouts: - '2006-01-02 15:04:05' timezone: "Local" { "@timestamp": "2024-04-12T06:37:52.000Z",
"@metadata": {
"beat": "filebeat",
"type": "_doc",
"version": "8.13.0"
},
"sip": "192.168.56.1",
"dport": 1900,
"sport": 60101,
"action": "ALLOW",
"message": "2024-04-12 15:37:52 ALLOW UDP 192.168.56.1 239.255.255.250 60101 1900 0 - - - - - - - SEND",
"dip": "239.255.255.250",
"timestamp": "2024-04-12 15:37:52",
"path": "SEND",
"protocol": "UDP"
}
{
"@timestamp": "2024-04-12T06:37:52.000Z",
"@metadata": {
"beat": "filebeat",
"type": "_doc",
"version": "8.13.0"
},
"sport": 60102,
"timestamp": "2024-04-12 15:37:52",
"action": "ALLOW",
"path": "SEND",
"sip": "192.168.31.177",
"dip": "239.255.255.250",
"message": "2024-04-12 15:37:52 ALLOW UDP 192.168.31.177 239.255.255.250 60102 1900 0 - - - - - - - SEND",
"protocol": "UDP",
"dport": 1900
}
{
"@timestamp": "2024-04-12T06:37:52.000Z",
"@metadata": {
"beat": "filebeat",
"type": "_doc",
"version": "8.13.0"
},
"message": "2024-04-12 15:37:52 ALLOW UDP 172.21.160.1 239.255.255.250 60103 1900 0 - - - - - - - SEND",
"protocol": "UDP",
"dip": "239.255.255.250",
"sip": "172.21.160.1",
"sport": 60103,
"action": "ALLOW",
"path": "SEND",
"dport": 1900,
"timestamp": "2024-04-12 15:37:52"
}
댓글 없음:
댓글 쓰기