Hey guys, trying to get osquery to send to a syslog receiver running on my logstash box, to get sent to ES. I changed the osquery.conf to use the

logger_plugin

, and when I query in Kibana, I get the following:

facility:local3 @timestamp:August 17th 2016, 23:20:54.000 @version:1 message: {"name":"system_info","hostIdentifier":"ubuntu","calendarTime":"Thu Aug 18 03:20:54 2016 UTC","unixTime":"1471490454","decorations":{"host_uuid":"6a570ff7-0ed8-4cba-b2ce-db209f345ad0","username":"ubuntu"},"columns":{"cpu_brand":"Intel(R) Core(TM) i7-4770HQ CPU @ 2.20GHz","hostname":"ubuntu","physical_memory":"2097823744"},"action":"added"} sysloghost:ubuntu severity:info programname:osqueryd procid:5688 type:rsyslog host:192.168.1.195 _id:AVabqncvN9PvrwNF3lsA _type:rsyslog _index:logstash-2016.08.18 _score: