logstash-cowrie.conf modification suggestion

[nnachtegael]

add target => honeypot in the logstash-cowrie.conf file to be able to find the commands imput field in elasticsearch discover

json {
source => message
target => honeypot
}

See https://discuss.elastic.co/t/log-entry-disappears-between-logstash-and-kibana/225850/7

[micheloosterhof]

Thanks for the suggestion! We'll put this in.

[nnachtegael]

Another way to retrieve the commands input variable as suggested in
https://githubmemory.com/repo/cowrie/cowrie/issues/1392

mutate {
    remove_field => [  "input" ]
}
json {
    source => message
}
...

[micheloosterhof]

#2062