# Author: Justin Henderson # SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics # Email: justin@hasecuritysolution.com # Last Update: 12/9/2016 input { tcp { port => 6053 codec => json type => "suricata" } } filter { if [type] == "suricata" { mutate { #add_tag => [ "conf_file_0005"] } } }