National Vulnerability Database (NVD) XML | JSON | logstash

logstash.conf

input {
    tcp {
        port => 5000
        codec => json_lines {
        }
    }
}

## Add your filters / logstash plugins configuration here
filter {
    mutate {
        add_field => {
            published => "%{[published-datetime]}"
            lastModified => "%{[last-modified-datetime]}"
            productList => "%{[vulnerable-software-list][0][product]}"
        }
        rename => {
            "cve-id" => "cveId"
        }
    }
    if [cwe] {
        mutate {
            add_field => {
                cweId => "%{[cwe][0][id]}"
            }
        }
    }
    if [cvss] {
        mutate {
            add_field => {
                score => "%{[cvss][0][base_metrics][0][score]}"
                authentication => "%{[cvss][0][base_metrics][0][authentication]}"
                accessComplexity => "%{[cvss][0][base_metrics][0][access-complexity]}"
                accessVector => "%{[cvss][0][base_metrics][0][access-vector]}"
                availabilityImpact => "%{[cvss][0][base_metrics][0][availability-impact]}"
                confidentialityImpact => "%{[cvss][0][base_metrics][0][confidentiality-impact]}"
                integrityImpact => "%{[cvss][0][base_metrics][0][integrity-impact]}"
            }
        }
    }
    ruby {
        code => "
            objectArray = []
            event.get('productList').split(',').each { |cpe|
                this_object = {}
                if match = cpe.match(/cpe:\/\w:([^:]+):([^:]+):?(.*)/i)
                    company, product, version = match.captures
                    this_object['company'] = company
                    this_object['product'] = product
                    this_object['version'] = version || ''
                end
                objectArray << this_object
            }
            event.set('products', objectArray)
        "
    }
    mutate {
        remove_field => ["cwe", "cvss", "id", "host", "port", "productList", "nvd_xml_version", "xmlns:xsi", "xmlns:vuln", "xmlns:scap-core", "xmlns:patch", "xmlns:cvss", "xmlns:cpe-lang", "pub_date", "last-modified-datetime", "published-datetime", "vulnerable-configuration", "vulnerable-software-list" ]
    }
    #date {
    #    match => [ "published-datetime", "YYYY-MM-dd'T'HH:mm:ss.SSS-ZZZ", "YYYY-MM-dd'T'HH:mm:ss.SSSZZZ" ]
    #}
}
output {
    #stdout { codec => rubydebug }
    elasticsearch {
        index => "cve-%{+YYYY.MM.dd}"
        hosts => "localhost:9200"
    }
}