I want to test osquery with ELK
ELK stack is ready and I want to test this on windows and ubuntu hosts
Does Osquery send logs to logstash itself? or I need to send osquery logs from log file with filebeats?
In my scenario is kolide a mandatory?
I dont need kolide fleet
I just need to get log from osquery periodic queries
08/14/2020, 1:03 PM
Osquery does not support logstash directly. You can have it write to local disk, and use filebeat as you suggested.
You can use a TLS server (like fleet) to manage and consolidate.
08/14/2020, 1:08 PM
Thank you, I dont need TLS in my environment
So I should send the content in osqueryd.results.log with filebeats to logstash, am I right?
08/14/2020, 1:20 PM
That is the log which contains the query results only
So yes if you're interested in that. Otherwise in the same folder where normally the results log end up to, there should also be message logs with their various levels (INFO, ERRORS)
08/14/2020, 1:36 PM
What type of logs are stored in those files?
Are they useful?
08/14/2020, 1:43 PM
TLS isn't so much about TLS. It's the remote control protocol. Required if you want to use osquery's life query, or the native mechanism to distribute configuration. If you have other config management tools you can use them.
08/14/2020, 2:33 PM
Hi @Erfan I want to apologies for the confusion I thought this was posted in the Kolide channel and in haste responded I am happy you got the correct resolution.
08/14/2020, 4:08 PM
Dear @seph I just need osquery for some periodical queries on my endpoints and have the results in json format on my elk stack
Do I need kolide or configuration management tool also in this case ?
08/14/2020, 5:06 PM
How will you get the configuration of the scheduled queries to your endpoints?
08/14/2020, 8:21 PM
Our endpoints are windows 10 mostly and I think the Microsoft SCCM can do this task
08/14/2020, 8:22 PM
But that’s the question you should work through.
* What installs osquery.
* Who maintains the osquery configuration
* What distributes the osquery configuration
* How are logs collected / aggregated
* How are logs analyzedThere’s no single answer here.
08/14/2020, 8:32 PM
Yes, thanks for your asnwers
My issue is on the last 2 items
Now I will send logs to elk with beats to parse them and then see what issues will happen