6.6. osquery: Collect and parse osquery result logs
The osquery application allows you to ask questions about your machine using an SQL-like language. For example, you can query running processes, logged in users, installed packages and syslog messages as well. You can make queries on demand, and also schedule them to run regularly.
osquery() source of syslog-ng PE allows you read the results of periodical osquery queries (from the
/var/log/osquery/osqueryd.results.log file) and automatically parse the messages (if you want to use syslog-ng PE to send log messages to osquery, read this blogpost). For example, you can:
Create filters from the fields of the messages.
Limit which fields to store, or create additional fields (combine multiple fields into one filed, and so on).
Send the messages to a central location, for example, to Elasticsearch, directly from syslog-ng PE.
The syslog-ng PE application automatically adds the
.osquery. prefix to the name of the fields the extracted from the message.
osquery() source is available in syslog-ng PE version 7.0.4 and later.
osquery() driver is actually a reusable configuration snippet configured to read the osquery log file using the
file() driver, and process its JSON contents. For details on using or writing such configuration snippets, see Section 5.9.2, Reusing configuration blocks. You can find the source of this configuration snippet on GitHub.
To configure a destination to send the log messages to Elasticsearch, see Section 7.2,
elasticsearch2: Sending messages directly to Elasticsearch version 2.0 or higher. For other destinations, see Chapter 7, Sending and storing log messages — destinations and destination drivers.