Skip to content

Instantly share code, notes, and snippets.

@0dadj1an

0dadj1an/logstash-juniper-filter.conf

Forked from n00b-sh3ll/logstash-juniper-filter.conf
Created August 28, 2019 15:18
Show Gist options
  • Save 0dadj1an/0250ddb709713344dba776df38668d13 to your computer and use it in GitHub Desktop.
Save 0dadj1an/0250ddb709713344dba776df38668d13 to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. cr4m05 renamed this gist Jun 21, 2016. 1 changed file with 0 additions and 0 deletions.
    0 logstash-juniper-filter → logstash-juniper-filter.conf
    View file
    File renamed without changes.
  2. cr4m05 created this gist Jun 21, 2016.
    63 changes: 63 additions & 0 deletions logstash-juniper-filter
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,63 @@
    input {
    tcp {
    port => 514
    type => syslog
    }
    udp {
    port => 514
    type => syslog
    }
    }


    filter {
    grok {
    match => { "message" => "<%{POSINT:syslog_pri}>%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }
    add_field => [ "received_at", "%{@timestamp}" ]
    add_field => [ "received_from", "%{host}" ]
    }
    syslog_pri { }
    date {
    match => [ "syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss" ]
    }
    if !("_grokparsefailure" in [tags]) {
    mutate {
    replace => [ "@source_host", "%{syslog_hostname}" ]
    replace => [ "@message", "%{syslog_message}" ]
    }
    }
    mutate {
    remove_field => [ "syslog_hostname", "syslog_message", "syslog_timestamp" ]
    }

    if [@message] =~ /^APPTRACK/ {
    grok {
    match => { "message" => "%{DATA:apptrack_status} %{IP:SRC_IP}/%{DATA:SRC_PORT}->%{IP:DST_IP}/%{WORD:DST_PORT} %{DATA:APP} %{DATA:APP}UNKNOWN UNKNOWN %{IP:SRC_NAT_IP}/%{DATA:SRC_NAT_PORT}->%{IP:DST_NAT_IP}/%{DATA:DST_NAT_PORT} %{DATA:RULE} None %{NUMBER:PROTO_CODE} %{DATA:RULE_POLICY} %{DATA:SRC_ZONE} %{DATA:DST_ZONE} %{NUMBER:BYTES}" }
    remove_field => [ "@message" ]
    add_tag => ["APPTRACK"]
    }
    }
    if [@message] =~ /^RT_FLOW_SESSION/ {
    grok {
    match => { "message" => "%{DATA:event}: session created %{IP:src_ip}/%{DATA:src_port}->%{IP:dst_ip}/%{DATA:dst_port} %{DATA:src_nat_rule} %{IP:src_nat_ip}/%{DATA:src_nat_port}->%{IP:dst_nat_ip}/%{DATA:dst_nat_port} None None %{INT:protocol_id} %{DATA:policy_name} %{DATA:src_zone} %{DATA:dst_zone} %{INT:session_id}\D+ %{DATA:interface} "}
    add_tag => ["RT_FLOW_SESSION"]
    }
    }

    geoip {
    source => "dst_ip"
    target => "geoip"
    database => "/etc/logstash/GeoLiteCity.dat"
    add_field => [ "[geoip][coordinates]", "%{[geoip][longitude]}" ]
    add_field => [ "[geoip][coordinates]", "%{[geoip][latitude]}" ]
    }

    mutate {
    convert => [ "[geoip][coordinates]", "float"]
    }

    }
    output {
    elasticsearch { hosts => ["localhost:9200"] }
    stdout { codec => rubydebug }
    }