elastic / elastic/integrations
[crowdstrike/fdr] logfile input not compatible with falcon_data_replicator.py
- Dominant language
- Handlebars
- Stars
- 333
- Forks
- 647
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 182
Description
The Crowdstrike FDR data stream contains a logfile input with the implied purpose of reading the logs written by https://github.com/CrowdStrike/FDR/blob/main/standalone/falcon_data_replicator.py. This script dumps `.gz` files from the S3 bucket onto the local filesystem. (The script can also replicate the files to your own S3 bucket. This along with SQS notification on your own bucket can be used with the s3 input part of the the integration.)
The problem is that the logfile input does not support reading from gzip files. So there's no way this can be compatible until https://github.com/elastic/beats/issues/637 is implemented. (The aws-s3 input can uncompress the gzip files so that's not a problem.)
Either we need to enhance the logfile input to support gzip or we need to remove the input from this integration since it cannot work.
Contributor guide
Assessment
This issue has not been assessed yet.