Hello everyone!
Do anybody know, is it possible to aggregate (bind) auditd events (I mean logs from audit/audit.log) in one by Record ID (Event ID)? I want to make in on parsing study, and to get in my index already aggregated events in one.
Hi @bosseres,
usually logs are indexed as they are.
Then you can display them aggregated as you like or detailed for each event.
Could you betetr describe your requirement?
Ciao.
Giuseppe
you are right, I can aggregate them, but problem that I have many searches where I need make the same one aggregation, it requires a lot of resources
is it any options to aggregate them before searching?
maybe any already ready solutions for auditd logs?
Hi @bosseres,
my hint is to create a scheduled search that aggregates logs asaving results in a summary index.
Then you can use this aggregated summary index for your searches.
Ciao.
Giuseppe