iac
/
syslog-ng
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

add nas81

This commit is contained in:
Kameron Kenny 2024-10-23 20:54:33 -04:00
parent 16f511d39a
commit 9c22be7c42
No known key found for this signature in database
GPG Key ID: E5006629839D2276
1 changed files with 44 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

44
config/syslog-ng.conf.d/nas81.conf Normal file
View File

@ -0,0 +1,44 @@
filter f_nas81_suricata { match("suricata" value("PROGRAM")); };
filter f_nas18_host { match("nas81" value("HOST")); };
parser p_kv { kv-parser(prefix("kv.")); };
parser p_suricata_dest_ip_geoip2_city {
geoip2(
"${suricata.dest_ip}",
prefix( "geoip2.destination." )
database( "/config/GeoIP/GeoLite2-City.mmdb" )
);
};
parser p_suricata_src_ip_geoip2_city {
geoip2(
"${suricata.src_ip}",
prefix( "geoip2.source." )
database( "/config/GeoIP/GeoLite2-City.mmdb" )
);
};
destination d_nas81_suricata {
elasticsearch-http(
index("nas81-suricata")
type("")
user("elastic")
password("forty6and2")
url("http://pi501.in.thelinuxpro.net:9200/_bulk")
template("$(format-json --scope rfc5424 --scope dot-nv-pairs
--rekey .* --shift 1 --scope nv-pairs
--exclude DATE @timestamp=${ISODATE})")
persist-name("d_nas81_suricata")
);
};
log {
source(s_network_udp);
filter(f_nas81_host);
parser(p_suricata_json);
parser(p_suricata_src_ip_geoip2_city);
parser(p_suricata_dest_ip_geoip2_city);
destination(d_nas81_suricata);
flags(final);
};