Logstash - DNS parcer for Suricata log

### DNS parcer for Suricata log
#
# Читаем локальный файл, пишем в Elastic
#
#
input {
    file {
        path => [ "/var/log/suricata/dns.log" ]
        sincedb_path => "/dev/null"
        start_position => "beginning" #Поменять на end#
    }
}

filter {
    ##### Simple DNS query #####
    if "Query" in [message] and "AAAA" not in [message] {
        grok {
            match => {
                "message" => "%{GREEDYDATA:timestamp}  ?\[?\*?\*?\] %{WORD:dns.message.type} %{WORD} %{WORD} ?\[?\*?\*?\] %{HOSTNAME:dns.request} ?\[?\*?\*?\] %{WORD:dns.record.type} ?\[?\*?\*?\] %{IP:dns.client.ip}:%{WORD:dns.client.port} %{GREEDYDATA} %{IP:dns.server.ip}:%{WORD:dns.server.port}"
            }
        }
        if "_grokparsefailure" in [tags] {
            drop { }
        }
    }
    if "Query" in [message] and "AAAA" in [message] {
        grok {
            match => {
                "message" => "%{GREEDYDATA:timestamp}  ?\[?\*?\*?\] %{WORD:dns.message.type} %{WORD} %{WORD} ?\[?\*?\*?\] %{DATA:dns.request} ?\[?\*?\*?\] %{WORD:dns.record.type} ?\[?\*?\*?\] %{IP:dns.client.ip}:%{WORD:dns.client.port} %{GREEDYDATA} %{IP:dns.server.ip}:%{WORD:dns.server.port}"
            }
        }
        if "_grokparsefailure" in [tags] {
            drop { }
        }
    }
    ##### Simple DNS response #####
    else if "Response" in [message] and "AAAA" not in [message] and "CNAME" not in [message] {
        grok {
            match => {
                "message" => "%{GREEDYDATA:timestamp}  ?\[?\*?\*?\] %{WORD:dns.message.type} %{WORD} %{WORD} ?\[?\*?\*?\] %{DATA:dns.request} ?\[?\*?\*?\] %{WORD:dns.record.type} ?\[?\*?\*?\] %{WORD} %{WORD:dns.ttl} ?\[?\*?\*?\] %{DATA:dns.reply.ip} ?\[?\*?\*?\] %{IP:dns.server.ip}:%{WORD:dns.server.port} %{GREEDYDATA} %{IP:dns.client.ip}:%{WORD:dns.client.port}"
            }
            add_tag => ["ip.v4"]
        }
        geoip {
            source => "dns.reply.ip"
        }
        if "_grokparsefailure" in [tags] {
            drop { }
        }
    }
    ##### IPv6 DNS response #####
    else if "Response" in [message] and "AAAA" in [message] and "CNAME" not in [message] {
        grok {
            match => {
                "message" => "%{GREEDYDATA:timestamp}  ?\[?\*?\*?\] %{WORD:dns.message.type} %{WORD} %{WORD} ?\[?\*?\*?\] %{DATA:dns.request} ?\[?\*?\*?\] %{WORD:dns.record.type} ?\[?\*?\*?\] %{WORD} %{WORD:dns.ttl} ?\[?\*?\*?\] %{DATA:dns.reply.ip} ?\[?\*?\*?\] %{IP:dns.server.ip}:%{WORD:dns.server.port} %{GREEDYDATA} %{IP:dns.client.ip}:%{WORD:dns.client.port}"
            }
            add_tag => ["ip.v6"]
        }
        if "_grokparsefailure" in [tags] {
            drop {}
        }
    }
    ##### IPv4 DNS response with CNAME ######
    else if "Response" in [message] and "AAAA" not in [message] and "CNAME" in [message] {
        grok {
            match => {
                "message" => "%{GREEDYDATA:timestamp}  ?\[?\*?\*?\] %{WORD:dns.message.type} %{WORD} %{WORD} ?\[?\*?\*?\] %{HOSTNAME:dns.cname.response} ?\[?\*?\*?\] %{WORD:dns.record.type} ?\[?\*?\*?\] %{WORD} %{WORD:dns.ttl} ?\[?\*?\*?\] %{HOSTNAME:dns.name.orig} ?\[?\*?\*?\] %{IP:dns.server.ip}:%{WORD:dns.server.port} %{GREEDYDATA} %{IP:dns.client.ip}:%{WORD:dns.client.port}"
            }
        }
        if "_grokparsefailure" in [tags] {
            drop {}
        }
    }
# гребанный timestam....
    date {
        match => ["timestamp", "MM/dd/yyyy-HH:mm:ss.SSSSSS"]
        timezone => "America/Toronto"
        target => ["@timestamp"]
    }
}
output {
        elasticsearch {
                hosts => ['IP этого сранного эластик-сервака:9200']
        }
}