95 lines
2.5 KiB
Plaintext
95 lines
2.5 KiB
Plaintext
input {
|
|
# tcp {
|
|
# port => 5000
|
|
# type => syslog
|
|
# }
|
|
# udp {
|
|
# port => 5000
|
|
# type => syslog
|
|
# }
|
|
file{
|
|
type => syslog
|
|
path => "/data/*"
|
|
start_position => "beginning"
|
|
}
|
|
}
|
|
filter {
|
|
if [type] == "syslog" {
|
|
syslog_pri{}
|
|
grok {
|
|
match => { "message" => [
|
|
"%{SYSLOGTIMESTAMP:syslog_timestamp} (%{SYSLOGHOST:syslog_hostname} |)%{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}",
|
|
"%{SYSLOGTIMESTAMP:syslog_timestamp} (%{SYSLOGHOST:syslog_hostname} |)%{GREEDYDATA:syslog_message}"
|
|
]
|
|
}
|
|
add_field => [ "received_at", "%{@timestamp}" ]
|
|
add_field => [ "received_from", "%{host}" ]
|
|
}
|
|
date {
|
|
match => [ "syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss" ]
|
|
}
|
|
mutate {
|
|
# replace => [ "message", "%{syslog_message}" ]
|
|
rename => [ "syslog_message", "message" ]
|
|
}
|
|
}
|
|
if [syslog_program] == "mwg"{
|
|
kv{
|
|
field_split => "|"
|
|
transform_key => "lowercase"
|
|
trim_value => '"'
|
|
target => "mwg"
|
|
add_tag => "mwg"
|
|
remove_field => "message"
|
|
include_keys => [
|
|
"devtime",
|
|
"referer",
|
|
"httpmethod",
|
|
"bytes",
|
|
"mediatype",
|
|
"useragent",
|
|
"blockreason",
|
|
"url",
|
|
"dst",
|
|
"httpstatus",
|
|
"src",
|
|
"urlcategories",
|
|
"usrname"
|
|
]
|
|
}
|
|
mutate{
|
|
convert => { "mwg[bytes]" => "integer" }
|
|
}
|
|
date{
|
|
match => ["mwg[devtime]" , "UNIX_MS"]
|
|
# target => "mwg[timestamp]"
|
|
}
|
|
useragent {
|
|
source => "mwg[useragent]"
|
|
target => "mwg[ua]"
|
|
}
|
|
geoip {
|
|
source => "mwg[dst]"
|
|
target => "mwg[dst_geo]"
|
|
}
|
|
# geoip {
|
|
# source => "mwg[src]"
|
|
# target => "mwg[src_geo]"
|
|
# }
|
|
#url aufteilen nach subdomain.domain.tld
|
|
grok {
|
|
match => { "mwg[url]" => "%{URIPROTO:mwg[urlparsed][proto]}://(?<mwg[urlparsed][subdom]>[^/]+)\.(?<mwg[urlparsed][domain]>[^/.]+)\.(?<mwg[urlparsed][tld]>[^/.]+)" }
|
|
}
|
|
|
|
|
|
# mutate {
|
|
# split => { "syslog_message" => "|" }
|
|
# }
|
|
|
|
}
|
|
}
|
|
output {
|
|
elasticsearch { hosts => ["elasticsearch:9200"] }
|
|
# stdout { codec => rubydebug }
|
|
}
|