Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- input {
- # filebeats
- beats {
- port => 5044
- type => "cowrie"
- }
- beats {
- port => 5045
- type => "suricata"
- }
- gelf {
- use_tcp => true
- port => 9044
- type => "wids"
- }
- }
- filter {
- if [type] == "cowrie" {
- json {
- source => message
- }
- date {
- match => [ "timestamp", "ISO8601" ]
- }
- if [src_ip] {
- mutate {
- add_field => { "src_host" => "%{src_ip}" }
- }
- dns {
- reverse => [ "src_host" ]
- nameserver => [ "8.8.8.8", "8.8.4.4" ]
- action => "replace"
- hit_cache_size => 4096
- hit_cache_ttl => 900
- failed_cache_size => 512
- failed_cache_ttl => 900
- }
- geoip {
- source => "src_ip"
- target => "geoip"
- database => "/opt/GeoLite2-City.mmdb"
- }
- }
- mutate {
- # cut out useless tags/fields
- remove_tag => [ "beats_input_codec_plain_applied"]
- remove_field => [ "[log][file][path]", "[log][offset]" ]
- }
- }
- if [type] == "suricata" {
- grok {
- match => {
- "message" => "%{GREEDYDATA:timestamp} ?\[?\*?\*?\] ?\[%{INT}:%{INT}:%{INT}?\] %{WORD} %{WORD} %{GREEDYDATA:ids.signature} ?\[?\*?\*?\] ?\[%{WORD}: %{GREEDYDATA:ids.classification}?\] ?\[%{WORD}: %{INT:ids.severity}?\] ?\{%{WORD:ids.protocol}?\} %{IP:src_ip}:%{INT:src_port} -> %{IP:dst_ip}:%{INT:dst_port}"
- }
- }
- if "_grokparsefailure" in [tags] {
- drop {}
- }
- geoip {
- source => "src_ip"
- }
- geoip {
- source => "dst_ip"
- }
- date {
- match => ["timestamp", "MM/dd/yyyy-HH:mm:ss.SSSSSS "]
- timezone => "America/Toronto"
- target => ["@timestamp"]
- }
- }
- }
- output {
- if [type] == "cowrie" {
- elasticsearch {
- hosts => ["127.0.0.1:9200"]
- ilm_enabled => auto
- ilm_rollover_alias => "cowrie-logstash"
- user => logstash_internal
- password => 'P@ssw0rd'
- }
- }
- else if [type] == "suricata" {
- elasticsearch {
- hosts => ["127.0.0.1:9200"]
- ilm_enabled => auto
- ilm_rollover_alias => "suricata-logstash"
- user => logstash_internal
- password => 'P@ssw0rd'
- }
- }
- else {
- elasticsearch {
- hosts => ["127.0.0.1:9200"]
- ilm_enabled => auto
- ilm_rollover_alias => "wids-logstash"
- user => logstash_internal
- password => 'P@ssw0rd'
- }
- }
- }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement