OpenAppID Stats

  • I'm trying to get the openapp id stats to elk.

    Using the u2openappid command to get the data into a logfile. This Logfile can then be send to logstash using syslog-ng.
    The problem i'am facing is that the file has a different name (timestamp) every time. hoping to use a cronjob running someting like this:

    u2openappid /var/log/snort/snort_em02035/app-stats.log.* > /var/syslog-ng/openappid.log

    And then use syslog-ng to tail the file:

    syslog(transport(udp) port(5150) ip(;
    file(“/var/syslog-ng/openappid.log” program_override(“OpenAppID”) flags(no-parse) follow_freq(1) );

    Anybody been trying the same?
    The result should be easy to parse using logstash so the problem is more getting it there.


Log in to reply