filter f_suricata { match("suricata" value("PROGRAM")); }; filter f_unifi_bash_history { match("bash" value("PROGRAM")); }; filter f_unifi_fw_lan { match("LAN_" value("PID")); }; filter f_unifi_fw_wan { match("WAN_" value("PID")); }; filter f_unifi_fw_dnat { match("DNAT_" value("PID")); }; filter f_unifi_fw_port_forward_dnat { match("PREROUTING-DNAT" value("PID")); }; filter f_unifi_fw_guest { match("GUEST_" value("PID")); }; filter f_unifi_dnsmasq { match("dnsmasq" value("PID")); }; filter f_unifi_systemd { match("systemd" value("PID")); }; filter f_unifi_stahtd { message("stahtd"); }; filter f_unifi_mcad { message("mcad"); }; filter f_unifi_hostapd { message("hostapd"); }; filter f_unifi_wlan { message("wlan:"); }; parser p_kv { kv-parser(prefix("kv.")); }; parser p_suricata_json { json-parser(prefix("suricata.")); }; parser p_fw_src_ip_geoip2_city { geoip2( "${kv.SRC}", prefix( "geoip2.source." ) database( "/config/GeoIP/GeoLite2-City.mmdb" ) ); }; parser p_fw_dst_ip_geoip2_city { geoip2( "${kv.DST}", prefix( "geoip2.destination." ) database( "/config/GeoIP/GeoLite2-City.mmdb" ) ); }; parser p_suricata_dest_ip_geoip2_city { geoip2( "${suricata.dest_ip}", prefix( "geoip2.destination." ) database( "/config/GeoIP/GeoLite2-City.mmdb" ) ); }; parser p_suricata_src_ip_geoip2_city { geoip2( "${suricata.src_ip}", prefix( "geoip2.source." ) database( "/config/GeoIP/GeoLite2-City.mmdb" ) ); }; destination d_unifi_fw { file("/var/log/unifi_fw.log"); }; destination d_unifi_suricata { elasticsearch-http( index("unifi-suricata") type("") user("elastic") password("forty6and2") url("http://pi501.in.thelinuxpro.net:9200/_bulk") template("$(format-json --scope rfc5424 --scope dot-nv-pairs --rekey .* --shift 1 --scope nv-pairs --exclude DATE @timestamp=${ISODATE})") persist-name("d_unifi_suricata") ); }; destination d_unifi_bash_history { elasticsearch-http( index("unifi-bash-history") type("") user("elastic") password("forty6and2") url("http://pi501.in.thelinuxpro.net:9200/_bulk") template("$(format-json --scope rfc5424 --scope dot-nv-pairs --rekey .* --shift 1 --scope nv-pairs --exclude DATE @timestamp=${ISODATE})") persist-name("d_unifi_bash_history") ); }; destination d_unifi_firewall { elasticsearch-http( index("unifi-firewall") type("") user("elastic") password("forty6and2") url("http://pi501.in.thelinuxpro.net:9200/_bulk") template("$(format-json --scope rfc5424 --scope dot-nv-pairs --rekey .* --shift 1 --scope nv-pairs --exclude DATE @timestamp=${ISODATE})") persist-name("d_unifi_firewall") ); }; destination d_unifi_dnsmasq { elasticsearch-http( index("unifi-dnsmasq") type("") user("elastic") password("forty6and2") url("http://pi501.in.thelinuxpro.net:9200/_bulk") template("$(format-json --scope rfc5424 --scope dot-nv-pairs --rekey .* --shift 1 --scope nv-pairs --exclude DATE @timestamp=${ISODATE})") persist-name("d_unifi_dnsmasq") ); }; destination d_unifi_systemd { elasticsearch-http( index("unifi-systemd") type("") user("elastic") password("forty6and2") url("http://pi501.in.thelinuxpro.net:9200/_bulk") template("$(format-json --scope rfc5424 --scope dot-nv-pairs --rekey .* --shift 1 --scope nv-pairs --exclude DATE @timestamp=${ISODATE})") persist-name("d_unifi_systemd") ); }; destination d_unifi_stahtd { elasticsearch-http( index("unifi-stahtd") type("") user("elastic") password("forty6and2") url("http://pi501.in.thelinuxpro.net:9200/_bulk") template("$(format-json --scope rfc5424 --scope dot-nv-pairs --rekey .* --shift 1 --scope nv-pairs --exclude DATE @timestamp=${ISODATE})") persist-name("d_unifi_stahtd") ); }; destination d_unifi_mcad { elasticsearch-http( index("unifi-mcad") type("") user("elastic") password("forty6and2") url("http://pi501.in.thelinuxpro.net:9200/_bulk") template("$(format-json --scope rfc5424 --scope dot-nv-pairs --rekey .* --shift 1 --scope nv-pairs --exclude DATE @timestamp=${ISODATE})") persist-name("d_unifi_mcad") ); }; destination d_unifi_hostapd { elasticsearch-http( index("unifi-hostapd") type("") user("elastic") password("forty6and2") url("http://pi501.in.thelinuxpro.net:9200/_bulk") template("$(format-json --scope rfc5424 --scope dot-nv-pairs --rekey .* --shift 1 --scope nv-pairs --exclude DATE @timestamp=${ISODATE})") persist-name("d_unifi_hostapd") ); }; destination d_unifi_wlan { elasticsearch-http( index("unifi-wlan") type("") user("elastic") password("forty6and2") url("http://pi501.in.thelinuxpro.net:9200/_bulk") template("$(format-json --scope rfc5424 --scope dot-nv-pairs --rekey .* --shift 1 --scope nv-pairs --exclude DATE @timestamp=${ISODATE})") persist-name("d_unifi_wlan") ); }; log { source(s_network_udp); filter(f_suricata); parser(p_suricata_json); parser(p_suricata_src_ip_geoip2_city); parser(p_suricata_dest_ip_geoip2_city); destination(d_unifi_suricata); flags(final); }; log { source(s_network_udp); filter(f_unifi_bash_history); destination(d_unifi_bash_history); flags(final); }; log { source(s_network_udp); filter(f_unifi_fw_lan); parser(p_kv); parser(p_fw_src_ip_geoip2_city); parser(p_fw_dst_ip_geoip2_city); destination(d_unifi_firewall); flags(final); }; log { source(s_network_udp); filter(f_unifi_fw_wan); parser(p_kv); parser(p_fw_src_ip_geoip2_city); parser(p_fw_dst_ip_geoip2_city); destination(d_unifi_firewall); flags(final); }; log { source(s_network_udp); filter(f_unifi_fw_dnat); parser(p_kv); parser(p_fw_src_ip_geoip2_city); parser(p_fw_dst_ip_geoip2_city); destination(d_unifi_firewall); flags(final); }; log { source(s_network_udp); filter(f_unifi_fw_port_forward_dnat); parser(p_kv); parser(p_fw_src_ip_geoip2_city); parser(p_fw_dst_ip_geoip2_city); destination(d_unifi_firewall); flags(final); }; log { source(s_network_udp); filter(f_unifi_fw_guest); parser(p_kv); parser(p_fw_src_ip_geoip2_city); parser(p_fw_dst_ip_geoip2_city); destination(d_unifi_firewall); flags(final); }; log { source(s_network_udp); filter(f_unifi_dnsmasq); destination(d_unifi_dnsmasq); flags(final); }; log { source(s_network_udp); filter(f_unifi_systemd); destination(d_unifi_systemd); flags(final); }; log { source(s_network_udp); filter(f_unifi_stahtd); destination(d_unifi_stahtd); flags(final); }; log { source(s_network_udp); filter(f_unifi_mcad); destination(d_unifi_mcad); flags(final); }; log { source(s_network_udp); filter(f_unifi_hostapd); destination(d_unifi_hostapd); flags(final); }; log { source(s_network_udp); filter(f_unifi_wlan); destination(d_unifi_wlan); flags(final); };