Is your feature request related to a problem? Please describe.
Sagan can currently only output eve logs to regular file, and only one at a time.
Describe the solution you'd like
The ability to output eve to a file, example /var/log/sagan.json while simultaneously writing to another log, perhaps to a ramdisk /tmp/ramdisk/sagan.json.
Also, Sagan cannot output eve to a fifo. There are workarounds where this does work, however Sagan will not keep the fifo open and let data spool when a reader/listener is not running.
Ideally, I'd be able to write eve to disk and a fifo simultaneously!
Describe alternatives you've considered
I looked into Suricata, and while it does not specify fifo as an output file type, there are options for unix_stream, unix_dgram, etc.
Is your feature request related to a problem? Please describe.
Sagan can currently only output eve logs to regular file, and only one at a time.
Describe the solution you'd like
The ability to output eve to a file, example /var/log/sagan.json while simultaneously writing to another log, perhaps to a ramdisk /tmp/ramdisk/sagan.json.
Also, Sagan cannot output eve to a fifo. There are workarounds where this does work, however Sagan will not keep the fifo open and let data spool when a reader/listener is not running.
Ideally, I'd be able to write eve to disk and a fifo simultaneously!
Describe alternatives you've considered
I looked into Suricata, and while it does not specify fifo as an output file type, there are options for unix_stream, unix_dgram, etc.