macos - 苹果系统日志到ELK

Question

有谁知道如何在像ELK这样的SIEM中导出mac os x的ASL日志？
是否在filebeat上进行配置以首先将其转换为文本格式。

我知道我们可以通过syslog –T utc –F raw读取它们

Answer 1

您应该能够通过log命令导出所有内容。有时我想分析个人笔记本电脑通过logstash和elasticsearch生成的日志。为了使日志进入logstash，我在tmux窗口中运行以下命令:

sudo log stream --info --debug |sudo -E socat -dddd STDIN TCP4:logstash.docker:6661,interval=4,reuseaddr,forever

我用logstash破解了几个黑帽，以解析macos系统日志，并且它们大部分时间都在工作。随意将它们用作您自己的日志。如果您设法改进它们，请发送给我(或要点链接)。

filter {
  grok {
    match => { "message" => "%{YEAR:year}-%{MONTHNUM:month}-%{MONTHDAY:day}\s+%{HOUR:hour}:%{MINUTE:minute}:%{SECOND:second}%{ISO8601_TIMEZONE:tz}%{GREEDYDATA}" }
    add_field => {"[log_timestamp]" => "%{year}-%{month}-%{day} %{hour}:%{minute}:%{second}%{tz}"}
    tag_on_failure => ["datefail_string"]
  }
  grok {
    match => { "message" => ["%{YEAR:year}-%{MONTHNUM:month}-%{MONTHDAY:day}\s+%{HOUR:hour}:%{MINUTE:minute}:%{SECOND:second}%{ISO8601_TIMEZONE:tz}\s+%{BASE16NUM:thread_id}\s+%{LOGLEVEL:log_type}\s+%{BASE16NUM:activity}\s+%{NUMBER:pid}\s+%{DATA:program}:\s+\(%{DATA:library}\)\s+\[%{DATA:package}\]\s+%{GREEDYDATA:msg}",  "%{YEAR:year}-%{MONTHNUM:month}-%{MONTHDAY:day}\s+%{HOUR:hour}:%{MINUTE:minute}:%{SECOND:second}%{ISO8601_TIMEZONE:tz}\s+%{BASE16NUM:thread_id}\s+%{LOGLEVEL:log_type}\s+%{BASE16NUM:activity}\s+%{NUMBER:pid}\s+%{DATA:program}:\s+\[%{DATA:package}\]\s+%{GREEDYDATA:msg}", "%{YEAR:year}-%{MONTHNUM:month}-%{MONTHDAY:day}\s+%{HOUR:hour}:%{MINUTE:minute}:%{SECOND:second}%{ISO8601_TIMEZONE:tz}\s+%{BASE16NUM:thread_id}\s+%{LOGLEVEL:log_type}\s+%{BASE16NUM:activity}\s+%{NUMBER:pid}\s+%{DATA:program}:%{GREEDYDATA:msg}"] }
      tag_on_failure => ["logfail1"]
    remove_field => ["message"]
  }

  mutate {
    remove_field => ["month","day","year","minute","hour","second","tz"]
  }
}