fluent-bit-input.conf

##########################################
# Define inputs in this file
# Since these are system-specific, this is a good place to also define what kind of the system we are working with - it would propagate to ECS observer.* fields

@SET observer_hostname=localhost

# NTA stands for network traffic analysis - more generic term than an IDS
@SET observer_type=nta
# Use bro for Bro 2.6+ or zeek for Zeek 3.+
@SET observer_product=bro
@SET observer_version=2.6.3

# Labels
@SET labels_pipeline=zeerbit-ecs
# Suggested values: production, qa, lab etc
@SET labels_env=default

# IMPORTANT! Make sure to point to an actual Zeek spool directory, not to a symlink. Fluent-bit tail DB doesn't work properly with symlinks, which results in duplicates.
@SET zeeklogdir=/usr/local/zeek/spool/zeek

[INPUT]
    Name    tail
    Tag     ${observer_product}.conn
    Path    ${zeeklogdir}/conn.log
    DB      ${FBIT_PATH}/tail.db
    # Interval Sec
    # ====
    # Read interval (sec) Default: 1
    #Refresh_Interval 5

#  Using https://github.com/corelight/json-streaming-logs for JSON logging
#[INPUT]
#    Name    tail
#    Tag     ${observer_product}.conn.json
#    Path    ${zeeklogdir}/json_streaming_conn.log
#    DB      ${FBIT_PATH}/tail.db
    # Interval Sec
    # ====
    # Read interval (sec) Default: 1
    #Refresh_Interval 5

[INPUT]
    Name    tail
    Tag     ${observer_product}.dhcp
    Path    ${zeeklogdir}/dhcp.log
    DB      ${FBIT_PATH}/tail.db
    # Interval Sec
    # ====
    # Read interval (sec) Default: 1
    #Refresh_Interval 5

#  Using https://github.com/corelight/json-streaming-logs for JSON logging
#[INPUT]
#    Name    tail
#    Tag     ${observer_product}.dhcp.json
#    Path    ${zeeklogdir}/json_streaming_dhcp.log
#    DB      ${FBIT_PATH}/tail.db
    # Interval Sec
    # ====
    # Read interval (sec) Default: 1
    #Refresh_Interval 5

[INPUT]
    Name    tail
    Tag     ${observer_product}.dns
    Path    ${zeeklogdir}/dns.log
    DB      ${FBIT_PATH}/tail.db
    # Interval Sec
    # ====
    # Read interval (sec) Default: 1
    #Refresh_Interval 5

#  Using https://github.com/corelight/json-streaming-logs for JSON logging
#[INPUT]
#    Name    tail
#    Tag     ${observer_product}.dns.json
#    Path    ${zeeklogdir}/json_streaming_dns.log
#    DB      ${FBIT_PATH}/tail.db
    # Interval Sec
    # ====
    # Read interval (sec) Default: 1
    #Refresh_Interval 5

[INPUT]
    Name    tail
    Tag     ${observer_product}.ssl
    Path    ${zeeklogdir}/ssl.log
    DB      ${FBIT_PATH}/tail.db
    # Interval Sec
    # ====
    # Read interval (sec) Default: 1
    #Refresh_Interval 5

#  Using https://github.com/corelight/json-streaming-logs for JSON logging
#[INPUT]
#    Name    tail
#    Tag     ${observer_product}.ssl.json
#    Path    ${zeeklogdir}/json_streaming_ssl.log
#    DB      ${FBIT_PATH}/tail.db
    # Interval Sec
    # ====
    # Read interval (sec) Default: 1
    #Refresh_Interval 5

[INPUT]
    Name    tail
    Tag     ${observer_product}.http
    Path    ${zeeklogdir}/http.log
    DB      ${FBIT_PATH}/tail.db
    # Interval Sec
    # ====
    # Read interval (sec) Default: 1
    #Refresh_Interval 5

#  Using https://github.com/corelight/json-streaming-logs for JSON logging
#[INPUT]
#    Name    tail
#    Tag     ${observer_product}.http.json
#    Path    ${zeeklogdir}/json_streaming_http.log
#    DB      ${FBIT_PATH}/tail.db
    # Interval Sec
    # ====
    # Read interval (sec) Default: 1
    #Refresh_Interval 5

[INPUT]
    Name    tail
    Tag     ${observer_product}.zeer_hosts
    Path    ${zeeklogdir}/zeer_hosts.log
    DB      ${FBIT_PATH}/tail.db
    # Interval Sec
    # ====
    # Read interval (sec) Default: 1
    #Refresh_Interval 5