Dionaea and Cowrie are low-interactive honeypots that can be installed on AWS to gather malware samples from attackers. Beats are used to ship logs from the honeypots to Elasticsearch via Logstash. The Grok filter in Logstash parses the ClamScan log format into key-value pairs to normalize the data before storing it in Elasticsearch. This allows the malware detections to be visualized in Kibana for real-time surveillance of malware activity.