input {
  file {
    type => "ossec-alerts"
    path => "/var/ossec/data/logs/alerts/alerts.json"
    codec => "json"
    }
}

filter {
        geoip {
                source => "srcip"
                target => "GeoLocation"
        }
        if [SyscheckFile][path] {
                mutate {
                        add_field => {"file" => "%{[SyscheckFile][path]}"}
                }
        }
        grok {
                match=> {
                        "file" => ["^/.+/(?<audit_file>(.+)$)|^[A-Z]:.+\\(?<audit_file>(.+)$)|^[A-Z]:\\.+/(?<audit_file>(.+)$)"]
                }
        }
        mutate {
                rename => [ "hostname", "AgentName" ]
                rename => [ "agentip", "AgentIP" ]
                rename => [ "[rule][comment]", "[rule][description]" ]
                rename => [ "[rule][level]", "[rule][AlertLevel]" ]
                remove_field => [ "timestamp", "beat", "fields", "input_type", "tags", "count" ]
        }
}

output {
        #stdout { codec => rubydebug }
        elasticsearch {
                 hosts => ["elasticsearch:9200"]
                 index => "ossec-%{+YYYY.MM.dd}"
                 document_type => "ossec"
                 template => "/etc/logstash/elastic5-ossec-template.json"
                 template_name => "ossec"
                 template_overwrite => true
        }
}