heka-lua-bro-notice

This configuration for heka ships notice logs for Bro stored in /nsm/bro/spool/manager/notice.log to mozdef.

We use here the Lua Sandbox for heka to parse our logs.

These log files have comments starting by # and have tab-delimited fields.

To run it:

rm -rf /var/cache/hekad/*
cp -rf bronotice.lua /usr/share/hekad
hekad -config=heka.toml