Nginx logs

[dustinschroder]

How do you set up logstash to ingest nginx logs in to security onion 2.3.250?

I have filebeat installed on the host and have enable the nginx module and defined the logs to ship.
I have no logs in being ingested, I assume this is because logstash doesn't understand what to do with when it receives it.
What is the correct way to add the correct pipelines? Form what I read I dont have a good grasp of how to set it up.

[dougburks]

Have you read all of this documentation?
https://docs.securityonion.net/en/2.3/filebeat.html#filebeat
https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-nginx.html

Specifically, have you reviewed the examples at https://docs.securityonion.net/en/2.3/filebeat.html#modules to see if you might be able to do something similar for nginx?

You can also check out our video at https://youtu.be/ew5gtVjAs7g to see another Filebeat module in action.