diff --git a/cowrie.cfg.dist b/cowrie.cfg.dist index 06a4093..2d0fe79 100644 --- a/cowrie.cfg.dist +++ b/cowrie.cfg.dist @@ -227,6 +227,14 @@ interact_port = 5123 [output_jsonlog] logfile = log/cowrie.json +# Supports logging to elasticsearch +# This is a simple early release +# +#[output-elasticsearch] +#host = localhost +#port = 9200 +#index = cowrie +#type = cowrie # Local Syslog output module # diff --git a/cowrie/output/elasticsearch.py b/cowrie/output/elasticsearch.py new file mode 100644 index 0000000..60a8f44 --- /dev/null +++ b/cowrie/output/elasticsearch.py @@ -0,0 +1,34 @@ +# Simple elasticsearch logger + +import os +import json + +import pyes + +import cowrie.core.output + + +class Output(cowrie.core.output.Output): + + + def __init__(self, cfg): + self.host = cfg.get('output_elasticsearch', 'host') + self.port = cfg.get('output_elasticsearch', 'port') + self.index = cfg.get('output_elasticsearch', 'index') + self.type = cfg.get('output_elasticsearch', 'type') + cowrie.core.output.Output.__init__(self, cfg) + + + def start(self): + self.es = pyes.ES('{0}:{1}'.format(self.host, self.port)) + + def stop(self): + pass + + def write(self, logentry): + for i in logentry.keys(): + # remove twisted 15 legacy keys + if i.startswith('log_'): + del logentry[i] + + self.es.index(logentry, self.index, self.type)