diff --git a/README.md b/README.md index 40be55f..4712e71 100644 --- a/README.md +++ b/README.md @@ -6,9 +6,9 @@ analyzer-d4-log relies on redis to consume grokked loglines. To grok the loglines, analyzer-d4-log relies on an external tool: both logstash https://www.elastic.co/logstash and nifi https://nifi.apache.org/ have been tested for this purpose (using this nifi template https://github.com/D4-project/d4-nifi-templates). -These tools poll directly the d4 server'redis server for loglines and push the results into a specific redis queue that the analyzer consumes. +These tools poll directly d4 server's redis for loglines and push the results into a specific redis queue that the analyzer consumes. -![](assets/nifi.png) +![Grokking D4 loglines in nifi](assets/nifi.png) analyzer-d4-log polls this queue periodically to produce counts and statistics of the data. At the moment, only sshd logs are supported but more will come in the future.