iac
/
syslog-ng
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

bind parsing

This commit is contained in:
Kameron Kenny 2024-06-19 16:04:34 -04:00
parent fca2ae5c60
commit ba51bbdcee
No known key found for this signature in database
GPG Key ID: E5006629839D2276
3 changed files with 29 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
Dockerfile
View File

@ -1,7 +1,7 @@
FROM debian:latest FROM debian:latest
MAINTAINER Kameron Kenny <kkenny379@gmail.com> MAINTAINER Kameron Kenny <kkenny379@gmail.com>
LABEL version="20240619.1.4" LABEL version="20240619.1.5"
LABEL description="Debian Based syslog-ng" LABEL description="Debian Based syslog-ng"
RUN apt-get update RUN apt-get update

29
config/syslog-ng.conf.d/bind-dns.conf
View File

@ -1,6 +1,27 @@
filter f_bind9_primary { message("bind9-primary"); }; filter f_bind9_primary { message("bind9-primary"); };
filter f_bind9_secondary { message("bind9-secondary"); }; filter f_bind9_secondary { message("bind9-secondary"); };
rewrite r_docker_image {
subst("^5000/tlp/", "image:", value("MESSAGE"));
subst(":(?=(\d*\.\d*\.\d*))", " version:", value("MESSAGE"));
subst('(\/)(?=\S*\[)', " container_name:", value("MESSAGE"));
subst('((?!=container_name:(\S*))\[(?=\d*))', " pid:", value("MESSAGE"));
subst('((?!=pid:(\d*))\]:)', "", value("MESSAGE"));
subst('((?!=pid:(\d*))\ )', " datetime:", value("MESSAGE"));
subst('((?!=datetime:(\d*-\w*-\d*))\ )', "_", value("MESSAGE"));
subst('((?!=datetime:(\d*-\w*-\d*_\d*)):)', ".", value("MESSAGE"));
subst('((?!=datetime:(\d*-\w*-\d*_\d*\.\d*)):)', ".", value("MESSAGE"));
};
parser p_bind_message {
csv-parser(
prefix("bind9.")
flags(strip-whitespace)
delimiters(" ")
columns("docker_header", "date", "time", "client.header", "client.object_id", "client.ip_port", "client.request", "query.header", "query.request", "query.class", "query.type", "query.flags")
);
};
parser p_bind_kv { parser p_bind_kv {
kv-parser( kv-parser(
prefix("bind9.") prefix("bind9.")
@ -33,7 +54,9 @@ destination d_bind_logs {
log { log {
source(s_network_udp); source(s_network_udp);
filter(f_bind9_primary); filter(f_bind9_primary);
parser(p_bind_kv); parser(p_bind_message);
# rewrite(r_docker_image);
#parser(p_bind_kv);
destination(d_bind_logs); destination(d_bind_logs);
flags(final); flags(final);
}; };
@ -41,7 +64,9 @@ log {
log { log {
source(s_network_udp); source(s_network_udp);
filter(f_bind9_secondary); filter(f_bind9_secondary);
parser(p_bind_kv); parser(p_bind_message);
# rewrite(r_docker_image);
# parser(p_bind_kv);
destination(d_bind_logs); destination(d_bind_logs);
flags(final); flags(final);
}; };

2
docker-compose.yml
View File

@ -10,7 +10,7 @@ services:
syslog-ng: syslog-ng:
build: build:
dockerfile: Dockerfile dockerfile: Dockerfile
image: docker-registry1.in.thelinuxpro.net:5000/tlp/syslog-ng:240619.1.4 image: docker-registry1.in.thelinuxpro.net:5000/tlp/syslog-ng:240619.1.5
container_name: syslog-ng container_name: syslog-ng
#environment: #environment:
#- TZ:America/Indianapolis #- TZ:America/Indianapolis