73 lines
2.0 KiB
Plaintext
73 lines
2.0 KiB
Plaintext
filter f_bind9_primary { message("bind9-primary"); };
|
|
filter f_bind9_secondary { message("bind9-secondary"); };
|
|
|
|
rewrite r_docker_image {
|
|
subst("^5000/tlp/", "image:", value("MESSAGE"));
|
|
subst(":(?=(\d*\.\d*\.\d*))", " version:", value("MESSAGE"));
|
|
subst('(\/)(?=\S*\[)', " container_name:", value("MESSAGE"));
|
|
subst('((?!=container_name:(\S*))\[(?=\d*))', " pid:", value("MESSAGE"));
|
|
subst('((?!=pid:(\d*))\]:)', "", value("MESSAGE"));
|
|
subst('((?!=pid:(\d*))\ )', " datetime:", value("MESSAGE"));
|
|
subst('((?!=datetime:(\d*-\w*-\d*))\ )', "_", value("MESSAGE"));
|
|
subst('((?!=datetime:(\d*-\w*-\d*_\d*)):)', ".", value("MESSAGE"));
|
|
subst('((?!=datetime:(\d*-\w*-\d*_\d*\.\d*)):)', ".", value("MESSAGE"));
|
|
};
|
|
|
|
parser p_bind_message {
|
|
csv-parser(
|
|
prefix("bind9.")
|
|
flags(strip-whitespace)
|
|
delimiters(" ")
|
|
columns("docker_header", "date", "time", "client.header", "client.object_id", "client.ip_port", "client.request", "query.header", "query.request", "query.class", "query.type", "query.flags")
|
|
);
|
|
};
|
|
|
|
parser p_bind_kv {
|
|
kv-parser(
|
|
prefix("bind9.")
|
|
value-separator(":")
|
|
);
|
|
};
|
|
|
|
parser p_bind_client_ip_geoip2_city {
|
|
geoip2(
|
|
"${kv.SRC}",
|
|
prefix( "geoip2.source." )
|
|
database( "/config/GeoIP/GeoLite2-City.mmdb" )
|
|
);
|
|
};
|
|
|
|
destination d_bind_logs {
|
|
elasticsearch-http(
|
|
index("bind9-logs")
|
|
type("")
|
|
user("elastic")
|
|
password("forty6and2")
|
|
url("http://pi501.in.thelinuxpro.net:9200/_bulk")
|
|
template("$(format-json --scope rfc5424 --scope dot-nv-pairs
|
|
--rekey .* --shift 1 --scope nv-pairs
|
|
--exclude DATE @timestamp=${ISODATE})")
|
|
persist-name("d_bind_logs")
|
|
);
|
|
};
|
|
|
|
log {
|
|
source(s_network_udp);
|
|
filter(f_bind9_primary);
|
|
parser(p_bind_message);
|
|
# rewrite(r_docker_image);
|
|
#parser(p_bind_kv);
|
|
destination(d_bind_logs);
|
|
flags(final);
|
|
};
|
|
|
|
log {
|
|
source(s_network_udp);
|
|
filter(f_bind9_secondary);
|
|
parser(p_bind_message);
|
|
# rewrite(r_docker_image);
|
|
# parser(p_bind_kv);
|
|
destination(d_bind_logs);
|
|
flags(final);
|
|
};
|