71 lines
1.9 KiB
Plaintext
71 lines
1.9 KiB
Plaintext
input {
|
|
beats {
|
|
host => "192.168.14.3"
|
|
port => 5044
|
|
type => "beats"
|
|
}
|
|
}
|
|
|
|
filter {
|
|
if [type] == "beats" {
|
|
mutate {
|
|
remove_field => [ "[host]" ]
|
|
}
|
|
mutate {
|
|
add_field => {
|
|
"host" => "%{[beat][hostname]}"
|
|
}
|
|
}
|
|
}
|
|
|
|
if [fields][log] == "fail2ban" {
|
|
grok {
|
|
match => {
|
|
"message" => "%{TIMESTAMP_ISO8601:timestamp} %{WORD:log_src}.%{WORD:src_action} *\[%{INT:fail2ban_digit}\]: %{LOGLEVEL:loglevel} *\[%{NOTSPACE:service}\] %{WORD:b
|
|
an_status} %{IP:clientip}"
|
|
}
|
|
}
|
|
geoip {
|
|
source => "clientip"
|
|
}
|
|
mutate {
|
|
convert => [ "[geoip][coordinates]", "float" ]
|
|
}
|
|
}
|
|
|
|
if [fields][log] == "apache-access" {
|
|
grok {
|
|
match => {
|
|
"message" => "%{HTTPD_COMBINEDLOG}+%{GREEDYDATA:extra_fields}"
|
|
}
|
|
overwrite => [ "message" ]
|
|
}
|
|
|
|
mutate {
|
|
convert => ["response", "integer"]
|
|
convert => ["bytes", "integer"]
|
|
convert => ["responsetime", "float"]
|
|
}
|
|
geoip {
|
|
source => "clientip"
|
|
target => "geoip"
|
|
add_tag => [ "apache-geoip" ]
|
|
}
|
|
date {
|
|
match => [ "timestamp" , "dd/MMM/YYYY:HH:mm:ss Z" ]
|
|
remove_field => [ "timestamp" ]
|
|
}
|
|
useragent {
|
|
source => "agent"
|
|
}
|
|
}
|
|
}
|
|
|
|
output {
|
|
if [type] == "beats" {
|
|
elasticsearch {
|
|
hosts => [ "127.0.0.1:9200" ]
|
|
}
|
|
}
|
|
}
|