Add Beelzebub

docker/elk/logstash/dist/logstash.conf

@@ -29,6 +29,13 @@ input {
     type => "Adbhoney"
   }
 
+# Beelzebub
+  file {
+    path => ["/data/beelzebub/log/beelzebub.json"]
+    codec => json
+    type => "Beelzebub"
+  }
+
 # Ciscoasa
   file {
     path => ["/data/ciscoasa/log/ciscoasa.log"]
@@ -253,6 +260,13 @@ filter {
     }
   }
 
+# Beelzebub
+  if [type] == "Beelzebub" {
+    date {
+      match => [ "timestamp", "ISO8601" ]
+    }
+  }
+
 # Ciscoasa
   if [type] == "Ciscoasa" {
     kv {