clay584

<?xml version="1.0"?>
<taxfile id="1692376550">
	...
</taxfile>

clay584

  file {
    path => ["/home/local/JTAX/curtisc/tax-returns/*"]
    start_position => "beginning"
    type => "tax_return"
    tags => [ "tax_return" ]
    codec => multiline {
      pattern => "^<\?xml .*\?>"
      negate => true
      what => "previous"
    }

clay584

<?xml version="1.0"?>
<taxfile id="1692376550">
...
		</jur>
		<splitsources/>
	</entity>
	<fee adjschcharge="65.00" code1="03.2013.0001.0002" fdfee="65.00" id="206" pricingoptionid="10" standardpricingtotal="65.00" totalfee="65.00" totalprepfee="65">
		<feedetail abbr="FD" cost="65" count="1" dcost="65.00" defid="1675" dfee="65.00" fee="65" flag="1" id="1" name="Form 1040EZ" tierid="1"/>
	</fee>

clay584

{
  "title": "Network Dashboard",
  "services": {
    "query": {
      "list": {
        "0": {
          "query": "Action=allow",
          "alias": "allow",
          "color": "#508642",
          "id": 0,

clay584

input {
  stdin { }
}
 
filter {
  #all of your fixed grok filters
}
 
output {
  elasticsearch {

clay584

input {
  udp {
    host => "0.0.0.0"
    port => 2055
    codec => netflow { cache_ttl => 1
                       versions => [ 5, 9 ]
                     }
    type => "netflow"
  }
}

clay584

input {
  udp {
    host => "0.0.0.0"
    port => 2055
    codec => netflow { cache_ttl => 1
                       versions => [ 5, 9 ]
                     }
    type => "netflow"
  }
}

clay584

#parse ASA log
      grok {
        patterns_dir => "/opt/logstash/logstash-1.4.0/patterns"
        break_on_match => false
        match => [ "raw_message", "%{CISCOFACSEVMNEM} %{WORD:Action} %{WORD:IPProtocol} src %{WORD:SourceZone}:%{IP:SourceAddress}\/%{POSINT:SourcePort} dst %{WORD:DestinationZone}:%{IP:DestinationAddress}\/%{POSINT:DestinationPort} by access-group \"%{NOTSPACE:rule}\"%{GREEDYDATA}",
                   "raw_message", "%{CISCOFACSEVMNEM} %{WORD:Action} %{IPPROTOCOL:IPProtocol} src %{WORD:SourceZone}:%{IP:SourceAddress} dst %{WORD:DestinationZone}:%{IP:DestinationAddress} %{DATA:icmp_type_code} by access-group \"%{WORD:Rule}\"%{GREEDYDATA}",
                   "raw_message", "%{CISCOFACSEVMNEM} %{GREEDYDATA:description}" ]
      }
      mutate {
        remove_field => [ "message", "raw_message" ]

clay584

input {
	file {
		#if you are reading files that syslog-ng has written to.
		path => ["/var/log/syslog-ng.log"]
		type => "syslog"
		tags => [ "network" ]
	}
	tcp {
		#if syslog-ng is relaying to logstash on TCP/514
		port => 514

clay584

CISCOTIMESTAMPTZ %{MONTH} +%{MONTHDAY}(?: %{YEAR})? %{TIME} %{TZ}