Logstash OSSEC parsing

ossec_logstash.conf

input {
  zeromq {
    type     => 'zmq'
    topology => 'pushpull'
    address  => 'tcp://*:5556'
    mode     => 'server'
  }
}

output {
  elasticsearch {
    cluster => "ELA003"
    index   => "ossec-logstash-%{+YYYY.MM.dd}"
    tags    => ["ossec"]
  }

  stdout {
    debug => true
    debug_format => "json"
    tags => ["ossec"]
  }
}

grep {
        tags => ["ossec"]
        add_tag => ["ossecproc"]
}

grok {
        tags      => ["ossecproc"]
        match   => [ "@message",  "%{GREEDYDATA:FIRST}\s%{GREEDYDATA:ID}\:\s%{GREEDYDATA:TYPE}\,\s%{YEAR:YEAR}\s%{MONTH:MONTH}\s%{MONTHDAY:MONTHDAY}\s%{TIME:TIME}\s\(ssh_integrity_check_linux\)\s%{GREEDYDATA:SERVER}\-\>syscheck\sRule\:\s%{INT:RULE}\s\(level\s%{INT:LEVEL}\)\s\-\>\s\'%{DATA:DESCRIPTION}\'\s%{GREEDYDATA:ORIGMESSAGE}" ]
	remove_tag => ["ossecproc"]
	add_tag  => ["ossec-integrity","ossec-match"]
}

grok {
	tags      => ["ossecproc"]
	match   => [ "@message",  "%{GREEDYDATA:FIRST}\s%{GREEDYDATA:ID}\:\s%{GREEDYDATA:TYPE}\,\s%{YEAR:YEAR}\s%{MONTH:MONTH}\s%{MONTHDAY:MONTHDAY}\s%{TIME:TIME}\s\(%{WORD:SERVER}\)\s%{IP:IP}\-\>%{GREEDYDATA:LOG}\sRule\:\s%{INT:RULE}\s\(level\s%{INT:LEVEL}\)\s\-\>\s\'%{GREEDYDATA:DESCRIPTION}\'\s%{GREEDYDATA:ORIGMESSAGE}" ]
	remove_tag => ["ossecproc"]
	add_tag  => ["ossec-alert","ossec-match"]
}

grok {
	tags      => ["ossecproc"]
	match   => [ "@message",  "%{GREEDYDATA:FIRST}\s%{GREEDYDATA:ID}\:\s-\s%{DATA:TYPE}\s%{YEAR:YEAR}\s%{MONTH:MONTH}\s%{MONTHDAY:MONTHDAY}\s%{TIME:TIME}\s\(%{DATA:SERVER}\)\s%{IP:IP}\-\>%{DATA:LOG}\sRule\:\s%{INT:RULE}\s\(level\s%{INT:LEVEL}\)\s\-\>\s\'%{GREEDYDATA:DESCRIPTION}\'\s%{GREEDYDATA:ORIGMESSAGE}" ]
	remove_tag => ["ossecproc"]
	add_tag  => ["ossec-syslog","ossec-match"]
}

grok {
	tags      => ["ossecproc"]
	match   => [ "@message",  "%{GREEDYDATA:FIRST}\s%{GREEDYDATA:ID}\:\s%{GREEDYDATA:TYPE}\,\s%{YEAR:YEAR}\s%{MONTH:MONTH}\s%{MONTHDAY:MONTHDAY}\s%{TIME:TIME}\s%{GREEDYDATA:SERVER}\-\>syscheck\sRule\:\s%{INT:RULE}\s\(level\s%{INT:LEVEL}\)\s\-\>\s\'%{DATA:DESCRIPTION}\'\s%{GREEDYDATA:ORIGMESSAGE}" ]
	remove_tag => ["ossecproc"]
	add_tag  => ["ossec-syslog","ossec-match"]
}

OSSEC now updated to write alerts as JSON to files. Eliminates the need for zeromq if you use logstash-forwarder.

http://notes.is9.co/2015/02/18/ossec-json-elk/