LogRhythm-SIEM_Create_Custom_Open_Collector_Pipelines_For_Kafkabeat

Creating Custom Open Collector Pipelines For Kafkabeat.

By default LR OpenCollecor does not have pipelines to process kafkabeat logs. Run below command to view the list of available pipelines in OC. We noticed by default OC does not have pipelines to process kafkabeat logs

./lrctl oc  -  - pipe status

Steps to create a custom pipeline for kafkabeat.

• Install ocpipeline utility

    ./lrctl ocpipeline  install
  

• Install lrjq utility

    ./lrctl lrjq install
  

• 

        ./ocpipeline create --name ociKafkaStream --destination .
  

• Paste the content of zip file to folder ociKafkaStream.

• To Understand the content of zip file go through Logrhythm Official document.

  ocikafkaStream.zip

• Run below command to Package and import the pipeline.

    ./ocpipeline package --source ociKafkaStream --destination . –-force
  

• We will see below output once above command executed successfully.

    .pipe file generated at: /root/ociKafkaStream.pipe
  

• Import .pipe file into your Open Collector.

    cat ociKafkaStream.pipe  | ./lrctl oc pipe import
  

• Restart Services.

    ./lrctl metrics restart
  

    ./lrctl oc restart
  

• Validate the status os all pipeline

    ./lrctl oc  -  - pipe status