Update doc (#47)

* Fixed docker-compose command * Updated logs structure
certego · Jul 31, 2023 · 028b4c3 · 028b4c3
1 parent 393693f
commit 028b4c3
Showing 1 changed file with 13 additions and 6 deletions.
diff --git a/README.md b/README.md
@@ -78,7 +78,7 @@ After that, there are two ways of running BuffaLogs, depending on your system co
     *  set the address of the host into the `CERTEGO_ELASTICSEARCH` variable in the `buffalogs.env` file
     *  launch ` docker-compose up -d` to run the containers
 * if you have no hosts with Elasticsearch installed on it, you can run it directly with Buffalogs:
-    * run `docker-compose -f docker-compose.yml -f docker-compose.elastic.yml up -d` in order to execute all the containers, included Elasticsearch and Kibana
+    * run `docker-compose -f docker-compose.yaml -f docker-compose.elastic.yaml up -d` in order to execute all the containers, included Elasticsearch and Kibana
     * Now elasticsearch and kibana are running on the same host with Buffalogs.
 
 ![buffalogs_dashboard_screenshot](https://user-images.githubusercontent.com/33703137/220879987-b6453e9d-0129-45c1-bc26-0542005e8730.png)
@@ -91,16 +91,23 @@ BuffaLogs is able to analyse logs coming from any source, provided that it compl
 
     ```
     {
+        "@timestamp" : <timestamp_isoformat>,
         "user": {
             "name": <user_name>
         },
         "event": {
-            "outcome": <"success" OR "failure">
+            "outcome": <"success" OR "failure">,
+            "category" : "authentication"
         },
-        "geoip": {
-            "latitude": <latitude>,
-            "longitude": <longitude>,
-            "country_name": <country_name>
+        "source" : {
+          "ip" : <source_ip_address>,
+          "geo" : {
+            "country_name" : <source_country_name>,
+            "location" : {
+              "lat" : <source_latitude>,
+              "lon" : <source_longitude>
+            }
+          }
         },
         "user_agent": {
             "original": <user_agent>