Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- input {
- beats {
- port => 5044
- ssl => false
- }
- }
- filter {
- if "alert TCP" in [message] {
- grok {
- match => {
- "message" => "%{GREEDYDATA:timestamp} ?\[?\*?\*?\] ?\[%{INT}:%{INT}:%{INT}?\] %{GREEDYDATA:signature} ?\[?\*?\*?\] ?\[%{WORD}: %{INT:priority}?\] ?\{%{WORD:protocol}?\} %{IP:ip.source}:%{INT:port.source} -> %{IP:ip.dst}:%{INT:port.dst}"
- }
- }
- if "_grokparsefailure" in [tags] {
- drop {}
- }
- }
- else if "alert ICMP" in [message] {
- grok {
- match => {
- "message" => "%{GREEDYDATA:timestamp} ?\[?\*?\*?\] ?\[%{INT}:%{INT}:%{INT}?\] %{GREEDYDATA:signature} ?\[?\*?\*?\] ?\[%{WORD}: %{INT:priority}?\] ?\{%{WORD:protocol}?\} %{IP:ip.source} -> %{IP:ip.dst}"
- }
- }
- if "_grokparsefailure" in [tags] {
- drop {}
- }
- }
- else {
- grok {
- match => {
- "message" => "%{GREEDYDATA:timestamp} ?\[?\*?\*?\] ?\[%{INT}:%{INT}:%{INT}?\] %{GREEDYDATA:signature} ?\[?\*?\*?\] ?\[%{WORD}: %{GREEDYDATA:classification}?\] ?\[%{WORD}: %{INT:priority}?\] ?\{%{WORD:protocol}?\} %{IP:ip.source}:%{INT:port.source} -> %{IP:ip.dst}:%{INT:port.dst}"
- }
- }
- if "_grokparsefailure" in [tags] {
- drop {}
- }
- }
- # date {
- # match => ["timestamp", "MM/dd-HH:mm:ss.SSSSSS"]
- # timezone => "America/Toronto"
- # target => ["@timestamp"]
- # }
- geoip {
- source => "ip.source"
- }
- geoip {
- source => "ip.dst"
- }
- }
- output {
- elasticsearch {
- hosts => ['127.0.0.1:9200']
- }
- }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement