Splitt syslog to different indices

[ByteAndBits]

Version

2.4.60

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Distributed

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

128

RAM

1TB

Storage for /

30TB

Storage for /nsm

60TB

Network Traffic Collection

span port

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

We have a lot of syslog sources. Now we want group this logs to different indices (Hypervisor, Firewalls, Switche, and so on).
We don´t want create for each group an own special Port.
How can we splitt the udp Syslog port to different indices, for example seperated by source IPs.

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[cm-ops]

It would be easiest to use the integrations, but if you need to keep everything on port 514, you could create a separate pipeline for each log type and use the custom configuration to send the logs to those custom pipelines.

[ByteAndBits]

Is there a how to or a doku for costom configuration? I never try this on this way.

[cm-ops]

A good place to start is here https://www.elastic.co/guide/en/elasticsearch/reference/current/ingest.html