105 lines
2.2 KiB
Plaintext
105 lines
2.2 KiB
Plaintext
filter f_nas81_suricata { match("suricata" value("PROGRAM")); };
|
|
filter f_nas81_host { match("nas81" value("HOST")); };
|
|
filter f_nas81_suricata_stats { match("suricata-stats" value("PROGRAM")); };
|
|
|
|
parser p_suricata_stats_json {
|
|
json-parser(
|
|
prefix("suricata.")
|
|
);
|
|
};
|
|
|
|
parser p_no_header {
|
|
syslog-parser(
|
|
flags(no-header)
|
|
);
|
|
};
|
|
|
|
parser p_no_parse {
|
|
syslog-parser(
|
|
flags(no-parse)
|
|
);
|
|
};
|
|
|
|
rewrite r_set_message {
|
|
set("extracted", value("MESSAGE"));
|
|
};
|
|
|
|
rewrite r_stats_rename {
|
|
rename("suricata.stats" "suricata_stats");
|
|
};
|
|
|
|
destination d_nas81_suricata {
|
|
elasticsearch-http(
|
|
index("nas81-suricata")
|
|
type("")
|
|
url("http://pi501.in.thelinuxpro.net:9200/_bulk")
|
|
template("$(format-json --scope rfc5424 --scope dot-nv-pairs
|
|
--rekey .* --shift 1 --scope nv-pairs
|
|
--exclude DATE @timestamp=${ISODATE})")
|
|
persist-name("d_nas81_suricata")
|
|
);
|
|
};
|
|
|
|
destination d_nas81_suricata_stats {
|
|
elasticsearch-http(
|
|
index("nas81")
|
|
type("")
|
|
url("http://pi501.in.thelinuxpro.net:9200/_bulk")
|
|
template(
|
|
"$(
|
|
format-json --scope rfc5424
|
|
--scope dot-nv-pairs
|
|
--scope nv-pairs
|
|
--exclude DATE @timestamp=${ISODATE}
|
|
)"
|
|
)
|
|
persist-name("d_nas81_suricata_stats")
|
|
);
|
|
};
|
|
|
|
destination d_file_suricata_stats {
|
|
file("/var/log/suricata_stats.log"
|
|
template(
|
|
"$(
|
|
format-json --scope rfc5424
|
|
--scope dot-nv-pairs
|
|
--scope nv-pairs
|
|
--exclude DATE @timestamp=${ISODATE}
|
|
)\n"
|
|
)
|
|
);
|
|
};
|
|
|
|
destination d_file_suricata {
|
|
file("/var/log/suricata.log"
|
|
template("$(format-json --scope rfc5424 --scope dot-nv-pairs
|
|
--rekey .* --shift 1 --scope nv-pairs
|
|
--exclude DATE @timestamp=${ISODATE})")
|
|
);
|
|
};
|
|
|
|
log {
|
|
source(s_network_udp);
|
|
filter(f_nas81_host);
|
|
filter(f_nas81_suricata_stats);
|
|
#parser(p_no_header);
|
|
parser(p_no_parse);
|
|
parser(p_suricata_stats_json);
|
|
# rewrite(r_stats_rename);
|
|
destination(d_nas81_suricata_stats);
|
|
destination(d_file_suricata_stats);
|
|
flags(final);
|
|
};
|
|
|
|
log {
|
|
source(s_network_udp);
|
|
filter(f_nas81_host);
|
|
filter(f_suricata);
|
|
parser(p_suricata_json);
|
|
parser(p_suricata_src_ip_geoip2_city);
|
|
parser(p_suricata_dest_ip_geoip2_city);
|
|
destination(d_nas81_suricata);
|
|
destination(d_file_suricata);
|
|
flags(final);
|
|
};
|