PiHole + Elasticsearch Ingest processing

README.md

NOTE - this was specifically built for a docker instance, with the Filebeat docker module collecting the logs.

filebeat.yml

#-------------------------- Elasticsearch output ------------------------------
output.elasticsearch:
# we need to do two when.contains here
  hosts: ["192.168.1.199:9206"]
  index: "filebeat-%{[beat.version]}-%{+yyyy.MM}"
  indices:
  - index: "filebeat-%{[beat.version]}-pihole-%{+yyyy.MM}"
    when.contains:
      message: "dnsmasq"
  pipelines:
  - pipeline: "pihole-logging"
    when.contains:
      message: "dnsmasq"

pipeline.json

PUT _ingest/pipeline/pihole-logging
{
  "description" : "Pi-Hole Logging",
  "processors": [
    {
      "grok": {
        "field": "message",
        "patterns": ["%{WORD:program_name}: %{POSINT:query_id} %{NOTSPACE:query_source} query%{NOTSPACE:query_record} %{NOTSPACE:query_target} from %{NOTSPACE:query_source}","%{WORD:program_name}: %{POSINT:query_id} %{NOTSPACE:query_source} %{NOTSPACE:query_action} %{NOTSPACE:query_target} is %{NOTSPACE:query_answer}"]
      }
    }
  ]
}