filter f_unifi_suricata { match("suricata" value("PROGRAM")); };
filter f_unifi_fw_lan { match("LAN_" value("PID")); };
filter f_unifi_stahtd { message("stahtd"); };

parser p_kv { kv-parser(prefix("kv.")); };

parser p_suricata_json { json-parser(prefix("suricata.")); };

parser p_fw_src_ip_geoip2_city {
  geoip2(
    "${kv.SRC}",
    prefix( "geoip2.source." )
    database( "/config/GeoIP/GeoLite2-City.mmdb" )
  );
};

destination d_unifi_fw { file("/var/log/unifi_fw.log"); };

destination d_unifi_suricata {
  elasticsearch-http(
    index("unifi-suricata")
    type("")
    user("elastic")
    password("forty6and2")
    url("http://pi501.in.thelinuxpro.net:9200/_bulk")
    template("$(format-json --scope rfc5424 --scope dot-nv-pairs
    --rekey .* --shift 1 --scope nv-pairs
    --exclude DATE @timestamp=${ISODATE})")
    persist-name("d_unifi_suricata")
  );
};

destination d_unifi_wlan {
  elasticsearch-http(
    index("unifi-wlan")
    type("")
    user("elastic")
    password("forty6and2")
    url("http://pi501.in.thelinuxpro.net:9200/_bulk")
    template("$(format-json --scope rfc5424 --scope dot-nv-pairs
    --rekey .* --shift 1 --scope nv-pairs
    --exclude DATE @timestamp=${ISODATE})")
    persist-name("d_unifi_wlan")
  );
};

log {
  source(s_network_udp);
  filter(f_unifi_suricata);
  parser(p_suricata_json);
  parser(p_suricata_src_ip_geoip2_city);
  parser(p_suricata_dest_ip_geoip2_city);
  destination(d_unifi_suricata);
  flags(final);
};

log {
  source(s_network_udp);
  filter(f_unifi_bash_history);
  destination(d_unifi_bash_history);
  flags(final);
};

log {
  source(s_network_udp);
  filter(f_unifi_fw_lan);
  parser(p_kv);
  parser(p_fw_src_ip_geoip2_city);
  parser(p_fw_dst_ip_geoip2_city);
  destination(d_unifi_firewall);
  flags(final);
};
