Dockerfile

@@ -1,7 +1,7 @@
 FROM debian:latest
 MAINTAINER Kameron Kenny <kkenny379@gmail.com>
 
-LABEL version="20241028.1.1"
+LABEL version="20241024.1.4"
 LABEL description="Debian Based syslog-ng"
 
 RUN apt-get update

config/syslog-ng.conf.d/nas81.conf

@@ -1,24 +1,12 @@
 filter f_nas81_suricata { match("suricata" value("PROGRAM")); };
 filter f_nas81_host { match("nas81" value("HOST")); };
-filter f_nas81_suricata_stats { match("stats" value("event_type")); };
-
-template t_json {
-  template("${MESSAGE}\n");
-  template-escape(no);
-};
-
-parser p_json {
-  json-parser(fields("json"));
-};
-
-parser p_suricata_stats_json {
-  json-parser(prefix("suricata.stats."));
-};
 
 destination d_nas81_suricata {
   elasticsearch-http(
     index("nas81-suricata")
     type("")
+    user("elastic")
+    password("forty6and2")
     url("http://pi501.in.thelinuxpro.net:9200/_bulk")
     template("$(format-json --scope rfc5424 --scope dot-nv-pairs
     --rekey .* --shift 1 --scope nv-pairs
@@ -27,24 +15,11 @@ destination d_nas81_suricata {
   );
 };
 
-destination d_nas81 {
-  elasticsearch-http(
-    index("nas81")
-    type("")
-    url("http://pi501.in.thelinuxpro.net:9200/_bulk")
-    template("$(format-json --scope rfc5424 --scope dot-nv-pairs
-    --rekey .* --shift 1 --scope nv-pairs
-    --exclude DATE @timestamp=${ISODATE})")
-    persist-name("d_nas81")
-  );
-};
-
 destination d_file_suricata { file("/var/log/suricata.log"); };
 
 log {
   source(s_network_udp);
   filter(f_nas81_host);
-  filter(f_suricata);
   parser(p_suricata_json);
   parser(p_suricata_src_ip_geoip2_city);
   parser(p_suricata_dest_ip_geoip2_city);
@@ -52,14 +27,3 @@ log {
   flags(final);
 };
 
-log {
-  source(s_network_udp);
-  filter(f_nas81_host);
-  filter(f_suricata);
-  filter(f_nas81_suricata_stats);
-  parser(p_suricata_stats_json);
-  parser(p_suricata_src_ip_geoip2_city);
-  parser(p_suricata_dest_ip_geoip2_city);
-  destination(d_nas81_suricata);
-  flags(final);
-};

config/syslog-ng.conf.d/unifi.conf

@@ -1,4 +1,4 @@
-filter f_suricata { match("suricata" value("PROGRAM")); };
+filter f_unifi_suricata { match("suricata" value("PROGRAM")); };
 filter f_unifi_bash_history { match("bash" value("PROGRAM")); };
 filter f_unifi_fw_lan { match("LAN_" value("PID")); };
 filter f_unifi_fw_wan { match("WAN_" value("PID")); };
@@ -178,7 +178,7 @@ destination d_unifi_wlan {
 
 log {
   source(s_network_udp);
-  filter(f_suricata);
+  filter(f_unifi_suricata);
   parser(p_suricata_json);
   parser(p_suricata_src_ip_geoip2_city);
   parser(p_suricata_dest_ip_geoip2_city);

docker-compose.yml

@@ -10,7 +10,7 @@ services:
   syslog-ng:
     build:
       dockerfile: Dockerfile
-    image: docker-registry1.in.thelinuxpro.net:5000/tlp/syslog-ng:241028.1.1
+    image: docker-registry1.in.thelinuxpro.net:5000/tlp/syslog-ng:241024.1.4
     container_name: syslog-ng
     restart: unless-stopped
     networks: