first commit

2016-11-22 12:50:26 -08:00
commit 02e5451452
15 changed files with 1054 additions and 0 deletions
@@ -0,0 +1,43 @@
+input {
+  file {
+    type => "ossec-alerts"
+    path => "/var/ossec/data/logs/alerts/alerts.json"
+    codec => "json"
+    }
+}
+
+filter {
+        geoip {
+                source => "srcip"
+                target => "GeoLocation"
+        }
+        if [SyscheckFile][path] {
+                mutate {
+                        add_field => {"file" => "%{[SyscheckFile][path]}"}
+                }
+        }
+        grok {
+                match=> {
+                        "file" => ["^/.+/(?<audit_file>(.+)$)|^[A-Z]:.+\\(?<audit_file>(.+)$)|^[A-Z]:\\.+/(?<audit_file>(.+)$)"]
+                }
+        }
+        mutate {
+                rename => [ "hostname", "AgentName" ]
+                rename => [ "agentip", "AgentIP" ]
+                rename => [ "[rule][comment]", "[rule][description]" ]
+                rename => [ "[rule][level]", "[rule][AlertLevel]" ]
+                remove_field => [ "timestamp", "beat", "fields", "input_type", "tags", "count" ]
+        }
+}
+
+output {
+        #stdout { codec => rubydebug }
+        elasticsearch {
+                 hosts => ["elasticsearch:9200"]
+                 index => "ossec-%{+YYYY.MM.dd}"
+                 document_type => "ossec"
+                 template => "/etc/logstash/elastic5-ossec-template.json"
+                 template_name => "ossec"
+                 template_overwrite => true
+        }
+}