slackhq / go-audit

go-audit is an alternative to the auditd daemon that ships with many distros

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Backend: go-audit events are not put into the streamstash index

pettai opened this issue · comments

  • I've read and understood the Contributing guidelines and have done my best effort to follow them.
  • I've read and agree to the Code of Conduct.
  • I've searched for any related issues and avoided creating a duplicate issue.

Description

Backend: streamstash wont put the go-audit events in the "streamstash" index

Reproducible in:

go-audit version: latest
streamstash version: latest, as the suggested version in the example docs (sudo npm install -g https://github.com/nbrownus/streamstash#2.0) didn't work
OS version(s): Ubuntu 16.04 (on both backend & client)

Steps to reproduce:

  1. Follow the example docs to install & configure
  2. Start up everything

Expected result:

According to the example docs a custom index should be created named "streamstash"
https://github.com/slackhq/go-audit/blob/master/examples/streamstash/streamstash.js#L21

Actual result:

streamstash puts all events in the (default?) "logstash-*" index

Attachments:

This appears to be a streamstash issue, mind bringing it up over there? streamstash

Yes, you're correct, moving it over there instead...