filter f_nas81_suricata { match("suricata" value("PROGRAM")); };
filter f_nas81_host { match("nas81" value("HOST")); };
filter f_nas81_suricata_stats { match("suricata-stats" value("PROGRAM")); };

parser p_suricata_stats_json {
  json-parser(
    prefix("suricata.")
  );
};

parser p_stats_json {
  json-parser();
};

parser p_no_header {
  syslog-parser(
    flags(no-header)
  );
};

parser p_no_parse {
  syslog-parser(
    flags(no-parse)
  );
};

rewrite r_brackets {
    subst('\[', '', value("MESSAGE"), flags("global"));
    subst('\]', '', value("MESSAGE"), flags("global"));
};

rewrite r_set_message {
  set("extracted", value("MESSAGE"));
};

rewrite r_stats_rename {
  rename("suricata.stats" "suricata_stats");
};

destination d_nas81_suricata {
  elasticsearch-http(
    index("nas81-suricata")
    type("")
    url("http://pi501.in.thelinuxpro.net:9200/_bulk")
    template("$(format-json --scope rfc5424 --scope dot-nv-pairs
    --rekey .* --shift 1 --scope nv-pairs
    --exclude DATE @timestamp=${ISODATE})")
    persist-name("d_nas81_suricata")
  );
};

destination d_nas81_suricata_stats {
  elasticsearch-http(
    index("nas81")
    type("")
    url("http://pi501.in.thelinuxpro.net:9200/_bulk")
    template(
      "$(
	format-json --scope rfc5424
	--scope dot-nv-pairs
	--scope nv-pairs
	--rekey .* --shift 1
	--exclude DATE @timestamp=${ISODATE}
      )"
    )
    persist-name("d_nas81_suricata_stats")
  );
};

destination d_file_suricata_stats {
  file("/var/log/suricata_stats.log"
    template(
      "$(
	format-json --scope rfc5424
	--scope dot-nv-pairs
	--scope nv-pairs
	--rekey .* --shift 1
	--exclude DATE @timestamp=${ISODATE}
      )\n"
    )
  );
};

destination d_file_suricata {
  file("/var/log/suricata.log"
    template("$(format-json --scope rfc5424 --scope dot-nv-pairs
    --rekey .* --shift 1 --scope nv-pairs
    --exclude DATE @timestamp=${ISODATE})")
  );
};

log {
  source(s_network_udp);
  parser(p_no_parse);
  filter(f_nas81_host);
  filter(f_nas81_suricata_stats);
  rewrite(r_brackets);
  parser(p_stats_json);
  #parser(p_no_header);
  #parser(p_suricata_stats_json);
#  rewrite(r_stats_rename);
  destination(d_nas81_suricata_stats);
  destination(d_file_suricata_stats);
  flags(final);
};

log {
  source(s_network_udp);
  filter(f_nas81_host);
  filter(f_suricata);
  parser(p_suricata_json);
  parser(p_suricata_src_ip_geoip2_city);
  parser(p_suricata_dest_ip_geoip2_city);
  destination(d_nas81_suricata);
  destination(d_file_suricata);
  flags(final);
};