0

So this is my syslog-ng configuration:

template raw_log {
         template("${MESSAGE}\n");
};

source s_eve {
    network(
        transport(tls)
        port(6514)
        tls(
            key-file("/etc/syslog-ng/ca.d/privkey.pem")
            cert-file("/etc/syslog-ng/ca.d/cacert.pem")
            peer-verify(optional-untrusted)
        )
        flags(no-parse,store-raw-message)
    );
};

destination d_logs_eve {
    file(
        "/var/log/suricata/eve.json"
        owner("root")
        group("root")
        perm(0777)
        template(raw_log)
    ); 
};

So i am using no-parse and store-raw-message, and I have also tried with this template:

template raw_log {
         template("${RAWMSG}\n");
};

But anyway, I get this in the file:

5468 <13>1 2023-07-10T09:43:48+00:00 14020836f0c7 {"timestamp" - - [meta sequenceId="1"] "2023-07-10T09:43:47.723612+0000","event_type":"stats","stats":{"uptime":43,"capture":{"kernel_packets":0,"kernel_drops":0,"errors":0},"decoder"

when I want just the raw message:

{"timestamp":"2023-07-10T09:43:47.723612+0000","event_type":"stats","stats":{"uptime":43,"capture":{"kernel_packets":0,"kernel_drops":0,"errors":0},"decoder"

So how do I get rid off that timestamp, servername and metadata? What am I doing wrong?

19mike95
  • 506
  • 2
  • 4
  • 19

0 Answers0