corelight / corelight/json-streaming-logs

Add option to send logs into a subfolder

Open
#13 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Zeek
Stars
31
Forks
11
PR merge metrics
No merged PRs in 30d

Description

Would be nice to set json_streaming logs to their own directory as an option.

example:
```
const JSONStreaming::enable_streaming_dir = F &redef;
...
...
...
if ( JSONStreaming::enable_streaming_dir)
local e = JsonStreamingExtension...
## send to path + '/json_streaming/'
else
## send to path with 'json_streaming_' filename (current state)
```

This isn't really an issue, but might be an easy add in to clean up the filenames to not have that prepended string, not sure why, but my eyes just don't like seeing it so I strip it down with a gsub at the filebeat layer. Maybe file rotation gets more challenging with this and that would make this a bad idea.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.