forked from wazuh/wazuh-docker
44 lines
1.3 KiB
Plaintext
44 lines
1.3 KiB
Plaintext
input {
|
|
file {
|
|
type => "ossec-alerts"
|
|
path => "/var/ossec/data/logs/alerts/alerts.json"
|
|
codec => "json"
|
|
}
|
|
}
|
|
|
|
filter {
|
|
geoip {
|
|
source => "srcip"
|
|
target => "GeoLocation"
|
|
}
|
|
if [SyscheckFile][path] {
|
|
mutate {
|
|
add_field => {"file" => "%{[SyscheckFile][path]}"}
|
|
}
|
|
}
|
|
grok {
|
|
match=> {
|
|
"file" => ["^/.+/(?<audit_file>(.+)$)|^[A-Z]:.+\\(?<audit_file>(.+)$)|^[A-Z]:\\.+/(?<audit_file>(.+)$)"]
|
|
}
|
|
}
|
|
mutate {
|
|
rename => [ "hostname", "AgentName" ]
|
|
rename => [ "agentip", "AgentIP" ]
|
|
rename => [ "[rule][comment]", "[rule][description]" ]
|
|
rename => [ "[rule][level]", "[rule][AlertLevel]" ]
|
|
remove_field => [ "timestamp", "beat", "fields", "input_type", "tags", "count" ]
|
|
}
|
|
}
|
|
|
|
output {
|
|
#stdout { codec => rubydebug }
|
|
elasticsearch {
|
|
hosts => ["elasticsearch:9200"]
|
|
index => "ossec-%{+YYYY.MM.dd}"
|
|
document_type => "ossec"
|
|
template => "/etc/logstash/elastic5-ossec-template.json"
|
|
template_name => "ossec"
|
|
template_overwrite => true
|
|
}
|
|
}
|