fluent-bit-test.conf

[SERVICE]
    # Flush
    # =====
    # Set an interval of seconds before to flush records to a destination
    Flush        5

    # Daemon
    # ======
    # Instruct Fluent Bit to run in foreground or background mode.
    Daemon       Off

    # Log_Level
    # =========
    # Set the verbosity level of the service, values can be:
    #
    # - error
    # - warning
    # - info
    # - debug
    # - trace
    #
    # By default 'info' is set, that means it includes 'error' and 'warning'.
    Log_Level    debug
    Log_File     ${FBIT_LOG}

    # Parsers_File
    # ============
    # Specify an optional 'Parsers' configuration file
    Parsers_File parsers.conf
    Plugins_File plugins.conf

    # HTTP Server
    # ===========
    # Enable/Disable the built-in HTTP Server for metrics
    HTTP_Server  Off
    HTTP_Listen  0.0.0.0
    HTTP_Port    2020


##########################################
# Define inputs FOR TESTING in this file
# Since these are system-specific, this is a good place to also define what kind of the system we are working with - it would propagate to ECS observer.* fields

@SET observer_hostname=testhost

# NTA stands for network traffic analysis - more generic term than an IDS
@SET observer_type=nta
# Use bro for Bro 2.6+ or zeek for Zeek 3.+
@SET observer_product=bro
@SET observer_version=2.6.3

# Labels
@SET labels_pipeline=zeerbit-ecs
@SET labels_env=development

#[INPUT]
#    Name    tail
#    Tag     ${observer_product}.conn
#    Path    /usr/local/etc/fluent-bit/test/conn.log
    # Interval Sec
    # ====
    # Read interval (sec) Default: 1
    #Refresh_Interval 5

#  Using https://github.com/corelight/json-streaming-logs for JSON logging
#[INPUT]
#    Name    tail
#    Tag     ${observer_product}.conn.json
#    Path    /usr/local/etc/fluent-bit/test/json_streaming_conn.log

#[INPUT]
#    Name    tail
#    Tag     ${observer_product}.dhcp
#    Path    /usr/local/etc/fluent-bit/test/dhcp.log
    # Interval Sec
    # ====
    # Read interval (sec) Default: 1
    #Refresh_Interval 5

#  Using https://github.com/corelight/json-streaming-logs for JSON logging
#[INPUT]
#    Name    tail
#    Tag     ${observer_product}.dhcp.json
#    Path    /usr/local/etc/fluent-bit/test/json_streaming_dhcp.log

#[INPUT]
#    Name    tail
#    Tag     ${observer_product}.dns
#    Path    /usr/local/etc/fluent-bit/test/dns.log
    # Interval Sec
    # ====
    # Read interval (sec) Default: 1
    #Refresh_Interval 5

#  Using https://github.com/corelight/json-streaming-logs for JSON logging
#[INPUT]
#    Name    tail
#    Tag     ${observer_product}.dns.json
#    Path    /usr/local/etc/fluent-bit/test/json_streaming_dns.log

#[INPUT]
#    Name    tail
#    Tag     ${observer_product}.ssl
#    Path    /usr/local/etc/fluent-bit/test/ssl.log
    # Interval Sec
    # ====
    # Read interval (sec) Default: 1
    #Refresh_Interval 5

#  Using https://github.com/corelight/json-streaming-logs for JSON logging
#[INPUT]
#    Name    tail
#    Tag     ${observer_product}.ssl.json
#    Path    /usr/local/etc/fluent-bit/test/json_streaming_ssl.log

#[INPUT]
#    Name    tail
#    Tag     ${observer_product}.http
#    Path    /usr/local/etc/fluent-bit/test/http.log
    # Interval Sec
    # ====
    # Read interval (sec) Default: 1
    #Refresh_Interval 5

#  Using https://github.com/corelight/json-streaming-logs for JSON logging
#[INPUT]
#    Name    tail
#    Tag     ${observer_product}.http.json
#    Path    /usr/local/etc/fluent-bit/test/json_streaming_http.log

[INPUT]
    Name    tail
    Tag     ${observer_product}.zeer_hosts
    Path    /usr/local/etc/fluent-bit/test/zeer_hosts.log
    # Interval Sec
    # ====
    # Read interval (sec) Default: 1
    #Refresh_Interval 5

@INCLUDE fluent-bit-filters.conf

[OUTPUT]
    Name  stdout
    Match ${observer_product}.*