logstash-juniper-filter.conf

input {
  tcp {
    port => 514
    type => syslog
  }
  udp {
    port => 514
    type => syslog
  }
}


filter {
        grok {
        match => { "message" => "<%{POSINT:syslog_pri}>%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }
        add_field => [ "received_at", "%{@timestamp}" ]
        add_field => [ "received_from", "%{host}" ]
        }
        syslog_pri { }
                date {
                match => [ "syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss" ]
        }
        if !("_grokparsefailure" in [tags]) {
        mutate {
                replace => [ "@source_host", "%{syslog_hostname}" ]
                replace => [ "@message", "%{syslog_message}" ]
        }
        }
        mutate {
                remove_field => [ "syslog_hostname", "syslog_message", "syslog_timestamp" ]
	}
	
	if [@message] =~ /^APPTRACK/ {
		grok {
		match => { "message" => "%{DATA:apptrack_status} %{IP:SRC_IP}/%{DATA:SRC_PORT}->%{IP:DST_IP}/%{WORD:DST_PORT} %{DATA:APP} %{DATA:APP}UNKNOWN UNKNOWN %{IP:SRC_NAT_IP}/%{DATA:SRC_NAT_PORT}->%{IP:DST_NAT_IP}/%{DATA:DST_NAT_PORT} %{DATA:RULE} None %{NUMBER:PROTO_CODE} %{DATA:RULE_POLICY} %{DATA:SRC_ZONE} %{DATA:DST_ZONE} %{NUMBER:BYTES}" }
		remove_field => [ "@message" ]
		add_tag => ["APPTRACK"]
		}
	}
	if [@message] =~ /^RT_FLOW_SESSION/ {
		grok {
		match => { "message" => "%{DATA:event}: session created %{IP:src_ip}/%{DATA:src_port}->%{IP:dst_ip}/%{DATA:dst_port} %{DATA:src_nat_rule} %{IP:src_nat_ip}/%{DATA:src_nat_port}->%{IP:dst_nat_ip}/%{DATA:dst_nat_port} None None %{INT:protocol_id} %{DATA:policy_name} %{DATA:src_zone} %{DATA:dst_zone} %{INT:session_id}\D+ %{DATA:interface} "}
		add_tag => ["RT_FLOW_SESSION"]
		}
	}
	
	geoip {
      		source => "dst_ip"
      		target => "geoip"
      		database => "/etc/logstash/GeoLiteCity.dat"
      		add_field => [ "[geoip][coordinates]", "%{[geoip][longitude]}" ]
      		add_field => [ "[geoip][coordinates]", "%{[geoip][latitude]}"  ]
    	}		
	
	mutate {
      		convert => [ "[geoip][coordinates]", "float"]
    	}

}
output {
	elasticsearch { hosts => ["localhost:9200"] }
  	stdout { codec => rubydebug }
}

**Utilizei este filter no Juniper SRX.
**Alterações no juniper --- http://www.juniper.net/documentation/en_US/junos12.1x44/topics/example/app-track-configuring-cli.html
geoip vai depender de quais informações você utilizará para análise.

This is great but does anyone know how to remove the double quotes out of the output? I'm trying with grok's mutate options but not having much luck

Hi,

If you mean remove in ES, use this -

trim_value => """

For example -

            kv {
                    source => "kvmessage"
                    trim_value => "\""
                    remove_field => [ "kvmessage" ]
                    remove_field => [ "message" ]
            }

Andy