Logstash - Cisco Log parcer

# Ежу, я думаю, понятно, что это только ознакомительная версия. Или - концепт, если хотите. Здесь еще пилить и пилить.
# Вместо считывания файлов - нормальный прием логов и многе
# Это просто для себя, чтоб не забыть
input {
    file {
        path => [ "/tmp/cisco/%3SWCOS-I-LOGACLINETPORTS.log" ]
        sincedb_path => "/dev/null"
        start_position => "beginning"
        tags => ["acl"]
    }
    file {
        path => [ "/tmp/cisco/%DHCPSNOOP-E-HDRMAC.log"]
        sincedb_path => "/dev/null"
        start_position => "beginning"
        tags => ["dhcp.snooping"]
    }
    file {
        path => [ "/tmp/cisco/%DHCPSNOOP-E-FILEENTRYREMD.log"]
        sincedb_path => "/dev/null"
        start_position => "beginning"
        tags => ["dhcp.snoo.lease"]
    }
    file {
        path => [ "/tmp/cisco/%LINK-I-Up.log" ]
        sincedb_path => "/dev/null"
        start_position => "beginning"
        tags => ["ifup"]
    }
    file {
        path => [ "/tmp/cisco/%LINK-W-Down.log" ]
        sincedb_path => "/dev/null"
        start_position => "beginning"
        tags => ["ifdown"]
    }
    file {
        path => [ "/tmp/cisco/%STP-W-PORTSTATUS.log" ]
        sincedb_path => "/dev/null"
        start_position => "beginning"
        tags => ["stp"]
    }
}
filter {
    if "acl" in [tags] {
        grok {
            match => {
                "message" => "%{GREEDYDATA:timestamp}-%{HOUR}:%{MINUTE} %{IP:cisco.ip} %{GREEDYDATA}: %{HOSTNAME:cisco.interface}: %{WORD:acl.action} %{WORD:acl.type} %{HOSTNAME:ip.protocol}?\(%{WORD:protocol}?\) %{IP:acl.source.ip}?\(%{NUMBER:acl.source.port}?\) %{GREEDYDATA} %{IP:acl.destination.ip}?\(%{NUMBER:acl.destination.port}"
            }
        }
        if "_grokparcefailure" in [tags] {
            drop { }
        }
        geoip {
            source => ["acl.source.ip"]
        }
        date {
            match => ["timestamp", "ISO8601"]
            timezone => "America/Toronto"
            target => ["@timestamp"]
        }
    }
    else if "dhcp.snooping" in [tags] {
        grok {
            match => {
                "message" => "%{GREEDYDATA:timestamp}-%{HOUR}:%{MINUTE} %{IP:cisco.ip} %{GREEDYDATA}: %{GREEDYDATA:snooping.event}: %{HOSTNAME} - %{NUMBER:snooping.vlan.id}, %{GREEDYDATA} - %{HOSTNAME:cisco.interface}, %{GREEDYDATA} - %{MAC:source.mac}, %{GREEDYDATA} - %{MAC:destination.mac}, %{GREEDYDATA} - %{MAC:client.mac}, %{GREEDYDATA} - %{GREEDYDATA:snooping.error.message}"
            }
        }
        if "_grokparcefailure" in [tags] {
            drop { }
        }
        date {
            match => ["timestamp", "ISO8601"]
            timezone => "America/Toronto"
            target => ["@timestamp"]
        }
    }
    else if "dhcp.snoo.lease" in [tags] {
        grok {
            match => {
                "message" => "%{GREEDYDATA:timestamp}-%{HOUR}:%{MINUTE} %{IP:cisco.ip} %{GREEDYDATA}: %{GREEDYDATA:snooping.event}: %{WORD} - %{NUMBER:vlan.id}, %{WORD} - %{MAC:client.mac}, %{WORD} - %{IP:client.ip}, %{WORD} - %{DATA:interface}, %{WORD} - %{NUMBER:type}, %{WORD} - %{GREEDYDATA:snooping.error.message}"
            }
        }
        if "_grokparcefailure" in [tags] {
            drop { }
        }
        date {
            match => ["timestamp", "ISO8601"]
            timezone => "America/Toronto"
            target => ["@timestamp"]
        }
    }
    else if "ifup" in [tags] {
        grok {
            match => {
                "message" => "%{GREEDYDATA:timestamp}-%{HOUR}:%{MINUTE} %{IP:cisco.ip} %{GREEDYDATA}:  %{HOSTNAME:cisco.interface}"
            }
        }
        if "_grokparcefailure" in [tags] {
            drop { }
        }
        date {
            match => ["timestamp", "ISO8601"]
            timezone => "America/Toronto"
            target => ["@timestamp"]
        }
    }
    else if "ifdown" in [tags] {
        grok {
            match => {
                "message" => "%{GREEDYDATA:timestamp}-%{HOUR}:%{MINUTE} %{IP:cisco.ip} %{GREEDYDATA}:  %{HOSTNAME:cisco.interface}"
            }
        }
        if "_grokparcefailure" in [tags] {
            drop { }
        }
        date {
            match => ["timestamp", "ISO8601"]
            timezone => "America/Toronto"
            target => ["@timestamp"]
        }
    }
    else if "stp" in [tags] {
        grok {
            match => {
                "message" => "%{GREEDYDATA:timestamp}-%{HOUR}:%{MINUTE} %{IP:cisco.ip} %{GREEDYDATA}: %{HOSTNAME:cisco.interface}: %{GREEDYDATA:stp.event}"
            }
        }
        if "_grokparcefailure" in [tags] {
            drop { }
        }
        date {
            match => ["timestamp", "ISO8601"]
            timezone => "America/Toronto"
            target => ["@timestamp"]
        }
    }
    else {
        drop { }
    }
}
output {
    elasticsearch {
        hosts => ['192.168.15.77:9200']
    }
}