https://github.com/osquery/osquery logo
Title
n

nyanshak

11/06/2019, 1:16 AM
I've got Fleet set up with the kinesis log plugin. This is not a new setup but I'm doing some review and I don't seem to be getting status logs in Kinesis. Does fleet have some default value that would disable status logs to kinesis? Or is there some option / flag I need to set to get the logging working to Kinesis? (I have not modified anything related to status logging flags either in my flag file or in fleet's options)
g

Gavin

11/07/2019, 8:41 PM
Hey is this still an issue for you ?
n

nyanshak

11/07/2019, 11:11 PM
Yes, but I don't think it's actually a fleet problem, but a problem with our config. Our log aggregator expects JSON-formatted logs with specific fields, otherwise it will drop the logs. Currently, we add those fields to results logs through decorators, but it doesn't look like there is a way to get status logs in json format, or to tag them with custom tags.