Where are the logstash logs or conf.d located?

[iqworks]

Hi,
I am using:
securityonion-2.3.190
windows 10

I have looked through several google searches. I keep getting locations where I look and its not there. I am looking for logstash.yml, conf.d and any other logstash config's. I am trying to see why my sysmon data dosnt get to kibana in the SOC.

/etc/logstash/conf.d (logsearch not found)

/opt/so/saltstack/local/pillar/

/opt/so/saltstack/local/salt/logstash (no logstash config file)

I see folders but nothing in them, especially conf.d

thanks for any help or advice

[cm-ops]

Take a look here https://docs.securityonion.net/en/latest/directory.html? But those specific logs are at /opt/so/log/logstash/logstash.log and /opt/so/conf/logstash/etc/logstash.yml.

[iqworks]

Hi cm-ops, i was on another project for the last couple of weeks. .
thanks for the reply. But I cannot see logstash?

I dont see it here either? /etc/logstash/conf. d
https://groups.google.com/g/security-onion/c/4FwPbMqmuEM

thanks for any suggestions or advice

[dougburks]

@iqworks Per your screenshot above, if the /opt/so/conf/ directory does not contain a logstash sub-directory, then that most likely means that you are running Security Onion in either Eval or Import mode. From https://docs.securityonion.net/en/2.3/logstash.html:

When Security Onion 2 is running in Standalone mode or in a full distributed deployment, Logstash transports unparsed logs to Elasticsearch which then parses and stores those logs. It’s important to note that Logstash does NOT run when Security Onion is configured for Import or Eval mode. You can read more about that in the Architecture section.

[iqworks]

Thanks Doug. how can I tell which mode I selected during setup? I wanted to do that before re-running sosetup. I looked here
https://docs.securityonion.net/en/2.3/help.html - it said "Setup /root/sosetup.log"? Is this where I can see how I set up this VM?
I went here but didnt find it?

Am I looking in the right place for this sosetup.log?

thanks again Doug

[iqworks]

my bad, I went here and see it now

I see this

I am going to run rerun sosetup.