73 lines
1.8 KiB
Plaintext
73 lines
1.8 KiB
Plaintext
filter f_unifi_suricata { match("suricata" value("PROGRAM")); };
|
|
filter f_unifi_fw_lan { match("LAN_" value("PID")); };
|
|
filter f_unifi_stahtd { message("stahtd"); };
|
|
|
|
parser p_kv { kv-parser(prefix("kv.")); };
|
|
|
|
parser p_suricata_json { json-parser(prefix("suricata.")); };
|
|
|
|
parser p_fw_src_ip_geoip2_city {
|
|
geoip2(
|
|
"${kv.SRC}",
|
|
prefix( "geoip2.source." )
|
|
database( "/config/GeoIP/GeoLite2-City.mmdb" )
|
|
);
|
|
};
|
|
|
|
destination d_unifi_fw { file("/var/log/unifi_fw.log"); };
|
|
|
|
destination d_unifi_suricata {
|
|
elasticsearch-http(
|
|
index("unifi-suricata")
|
|
type("")
|
|
user("elastic")
|
|
password("forty6and2")
|
|
url("http://pi501.in.thelinuxpro.net:9200/_bulk")
|
|
template("$(format-json --scope rfc5424 --scope dot-nv-pairs
|
|
--rekey .* --shift 1 --scope nv-pairs
|
|
--exclude DATE @timestamp=${ISODATE})")
|
|
persist-name("d_unifi_suricata")
|
|
);
|
|
};
|
|
|
|
destination d_unifi_wlan {
|
|
elasticsearch-http(
|
|
index("unifi-wlan")
|
|
type("")
|
|
user("elastic")
|
|
password("forty6and2")
|
|
url("http://pi501.in.thelinuxpro.net:9200/_bulk")
|
|
template("$(format-json --scope rfc5424 --scope dot-nv-pairs
|
|
--rekey .* --shift 1 --scope nv-pairs
|
|
--exclude DATE @timestamp=${ISODATE})")
|
|
persist-name("d_unifi_wlan")
|
|
);
|
|
};
|
|
|
|
log {
|
|
source(s_network_udp);
|
|
filter(f_unifi_suricata);
|
|
parser(p_suricata_json);
|
|
parser(p_suricata_src_ip_geoip2_city);
|
|
parser(p_suricata_dest_ip_geoip2_city);
|
|
destination(d_unifi_suricata);
|
|
flags(final);
|
|
};
|
|
|
|
log {
|
|
source(s_network_udp);
|
|
filter(f_unifi_bash_history);
|
|
destination(d_unifi_bash_history);
|
|
flags(final);
|
|
};
|
|
|
|
log {
|
|
source(s_network_udp);
|
|
filter(f_unifi_fw_lan);
|
|
parser(p_kv);
|
|
parser(p_fw_src_ip_geoip2_city);
|
|
parser(p_fw_dst_ip_geoip2_city);
|
|
destination(d_unifi_firewall);
|
|
flags(final);
|
|
};
|