Feature request: Option to disable writing zeek log files for categories excluded from processing

[jimhranicky]

When adding zeek logs to be excluded from processing here:

elasticfleet > logging > zeek > excluded

It would also be nice if there was an option to exclude the logs in the zeek.local config, e.g.:

# Kill Syslog logging
event zeek_init() {
    Log::disable_stream(Syslog::LOG);
}

That would save lots of processing power and disk, especially for high volume traffic that will not be processed.

[cm-ops]

Currently you can drop the script in /opt/so/saltstack/local/salt/zeek/policy/custom/ then add it to Administration –> Configuration –> zeek -> config -> local -> load with a line like custom/log_disable_script

[jimhranicky]

For now I've just copied the jinja file to

/opt/so/saltstack/local/salt/zeek/files/local.zeek.jinja

and added the disable stanzas there, which seems to be working, it would just be nice if this were part of the disable process.

[cm-ops]

That works too, but keep in mind if there are future changes to the local.zeek.jinja in the default path, you may have to copy a new one over and place your config again.