> ## Documentation Index
> Fetch the complete documentation index at: https://docs.obsidianlog.com/llms.txt
> Use this file to discover all available pages before exploring further.

# SIEM Export

> Forward archived logs into a SIEM using obsidianlog query --format raw. NDJSON, no custom parsing needed.

`obsidianlog query --format raw` emits NDJSON: one JSON object per line,
the original ingested event, unmodified. Mainstream SIEM tooling ingests
this natively:

```sh theme={null}
obsidianlog query --format raw --from 24h > /var/log/obsidianlog/archive.ndjson
```

Run this on a schedule (cron, a systemd timer) for ongoing export. A
one-off `query` run is a snapshot of what matched at that moment, not a live
tail of new archives as they land.

<Note>
  This is an example, not a shipped integration. See the config files' own
  comments for what to change before using them for real (endpoints, index
  names, credentials).
</Note>

## Filebeat → Elasticsearch/Logstash

A `filestream` input tails the exported file and parses each line as
NDJSON. No custom Filebeat processors are needed, since the shape is
already flat JSON per line:

```yaml theme={null}
filebeat.inputs:
  - type: filestream
    id: obsidianlog-archive
    paths:
      - /var/log/obsidianlog/archive.ndjson
    parsers:
      - ndjson:
          keys_under_root: true
          add_error_key: true
          overwrite_keys: true

output.elasticsearch:
  hosts: ["https://your-elasticsearch-host:9200"]
```

Full config, including the Logstash-output alternative:
[`examples/integrations/siem/filebeat.yml`](https://github.com/emmaglorypraise/ObsidianLog/blob/main/examples/integrations/siem/filebeat.yml).

## Splunk

A `monitor://` stanza with `INDEXED_EXTRACTIONS = json` tells Splunk to
parse each line as a JSON event directly:

```ini theme={null}
[monitor:///var/log/obsidianlog/archive.ndjson]
disabled = false
index = obsidianlog
sourcetype = obsidianlog:ndjson
INDEXED_EXTRACTIONS = json
KV_MODE = none
```

Full config:
[`examples/integrations/siem/splunk-inputs.conf`](https://github.com/emmaglorypraise/ObsidianLog/blob/main/examples/integrations/siem/splunk-inputs.conf).
Drop it into `$SPLUNK_HOME/etc/apps/<your_app>/local/inputs.conf` and
restart the forwarder/instance.

## Why this needs no custom integration code

`--format raw`'s output is exactly the log event as it was originally
ingested. SIEM tools that already parse JSON logs (most of them) need
nothing ObsidianLog-specific to consume it. The interesting property here
isn't the export format, which is just JSON. It's that what you're
exporting was tamper-evident and hash-chained the whole time it was
archived ([`obsidianlog verify`](/cli/verify)), unlike logs that only ever
lived in a mutable hot-tier index.