logstash logging for honeypots

docker/elk/logstash/dist/logstash.conf

@@ -112,6 +112,13 @@ input {
     type => "Heralding"
   }
 
+# Honeypots
+  file {
+    path => ["/data/honeypots/log/*.log"]
+    codec => json
+    type => "Honeypots"
+  }
+
 # Honeypy
   file {
     path => ["/data/honeypy/log/json.log"]
@@ -491,6 +498,13 @@ filter {
     }
   }
 
+# Honeypots
+  if [type] == "Honeypots" {
+    date {
+      match => [ "timestamp", "ISO8601" ]
+    }
+  }
+
 # Honeysap
   if [type] == "Honeysap" {
     date {