Logstash - OpenVPN

#########################################################################
##### ВЕРСИЯ НЕ РАБОЧАЯ!!!! ТОЛЬКО ДЛЯ СЕБЯ ЧТОБ ДОПИЛИТЬ ДО УМА!!!! ####
#########################################################################

################# INPUT #################

input {
    file {
        path => [ "/tmp/openvpn/openvpn.*" ]
        sincedb_path => "/dev/null"
        start_position => "beginning"
    }
}

################# FILTER #################

filter {
    if "IV_PLAT=" in [message] {    # Операционная система клиента
        grok {
            match => {
                "message" => "%{MONTH:month} %{MONTHDAY:day} %{TIME:time} %{WORD:logsource} %{SYSLOGPROG} ?\[%{WORD:pid}?]: %{IP:ovpn.source.ip}:%{WORD} %{WORD} %{WORD}: %{WORD}=%{GREEDYDATA:ovpn.client.plat}"
            }
            add_tag => ["Client OS"]
        }
        if "_grokparsefailure" in [tags] {
            drop { }
        }
    }
    else if "IV_GUI_VER=" in [message] {    # Используемая программа-клиент
        grok {
            match => {
                "message" => "%{MONTH:month} %{MONTHDAY:day} %{TIME:time} %{WORD:logsource} %{SYSLOGPROG} ?\[%{WORD:pid}?]: %{IP:ovpn.source.ip}:%{WORD} %{WORD} %{WORD}: %{WORD}=%{GREEDYDATA:ovpn.client.guiversion}"
            }
            add_tag => ["Clien GUI"]
        }
        if "_grokparsefailure" in [tags] {
            drop { }
        }
    }
    else if "primary virtual IP" in [message] { # Событие подключения, выдача внутреннего ip клиенту
        grok {
            match => {
                "message" => "%{MONTH:month} %{MONTHDAY:day} %{TIME:time} %{WORD:logsource} %{SYSLOGPROG} ?\[%{WORD:pid}?]: %{WORD:ovpn.client}/%{IP:ovpn.source.ip}:%{WORD:ovpn.source.port} %{WORD}: %{WORD} %{WORD} %{WORD} %{WORD} %{WORD}/%{IP}:%{WORD}: %{IP:ovpn.internal.ip}"
            }
            add_tag => ["Connected"]
        }
        if "_grokparsefailure" in [tags] {
            drop { }
        }
    }
    else if "TLS Error:" in [message] { # Обрыв связи, проблемы сети
        grok {
            match => {
                "message" => "%{MONTH:month} %{MONTHDAY:day} %{TIME:time} %{WORD:logsource} %{SYSLOGPROG} ?\[%{WORD:pid}?]: %{WORD}/%{IP}:%{WORD:port} %{GREEDYDATA:ovpn.error.event}: %{GREEDYDATA:ovpn.error.message}"
            }
            add_tag => ["TLS Error"]
        }
        if "_grokparsefailure" in [tags] {
            drop { }
        }
    }
    else if "TLS Error: cannot locate" in [message] {   # Попытки подключения левых юзеров
        grok {
            match => {
                "message" => "%{MONTH:month} %{MONTHDAY:day} %{TIME:time} %{WORD:logsource} %{SYSLOGPROG} ?\[%{WORD:pid}?]: %{GREEDYDATA:ovpn.error.event}: %{GREEDYDATA:ovpn.error.message} %{WORD} ?\[%{WORD}?]%{IP:ovpn.source.ip}:%{WORD:ovpn.source.port}"
            }
            add_tag => ["cannot locate"]
        }
        if "_grokparsefailure" in [tags]
        {
            drop { }
        }
    }
    else if "VERIFY ERROR" in [message] {   # Сертификат клиента - ВСЁ
        grok {
            match => {
                "message" => "%{MONTH:month} %{MONTHDAY:day} %{TIME:time} %{WORD:logsource} %{SYSLOGPROG} ?\[%{WORD:pid}?]: %{IP:ovpn.source.ip}:%{WORD:ovpn.source.port} %{GREEDYDATA:ovpn.error.event}: %{WORD}=%{GREEDYDATA}, error=%{GREEDYDATA:ovpn.error.message}: %{WORD}=%{WORD:ovpn.client}"
            }
            add_tag => ["VERIFY ERROR"]
        }
        if "_grokparsefailure" in [tags] {
            drop { }
        }
    }
    else {
        drop { }
    }
}

################# OUTPUT #################

output {
#   elasticsearch {
#       hosts => ['192.168.15.77:9200']
#   }
##### DEBUG OSTI D'CALISSE DE TABARNAK!!! ##### Отправка в разные файлы для гребанного дебага
    if "Connected" in [tags] {
        file {
            path => "/tmp/vpn_connected.json"
            codec => "json_lines"
        }
    }
    else if "TLS Error" in [tags] {
        file {
            path => "/tmp/vpn_tls.json"
            codec => "json_lines"
        }
    }
    else if "cannot locate" in [tags] {
        file {
            path => "/tmp/vpn_cannot.json"
            codec => "json_lines"
        }
    }
    else if "VERIFY ERROR" in [tags] {
        file {
            path => "/tmp/vpn_verify.json"
            codec => "json_lines"
        }
    }
    else if "Client OS" in [tags] {
        file {
            path => "/tmp/vpn_os.json"
            codec => "json_lines"
        }
    }
    else if "IV_GUI_VER=" in [tags] {
        file {
            path => "/tmp/vpn_gui.json"
            codec => "json_lines"
        }
    }
    else {
        file {
            path => "/tmp/else.json"
            codec => "json_lines"
        }
    }

}