Logstash Config

gistfile1.txt

input {
	tcp {
		port => 5000
		type => "syslog"
	}
	tcp {
		type   => "eventlog"
		port   => 3515
		codec => json_lines
	}
	tcp {
		type => "iislog"
		port => 3516
		codec => json_lines
	}
}

filter {
	if [type] == "syslog" {
		grok {
			match => { "message" => "<%{POSINT:syslog_pri}>%{DATA:syslog_timestamp} %{DATA:syslog_program}\[%{NUMBER:syslog_pid}\]\: %{GREEDYDATA:syslog_message}" }
			add_field => [ "received_at", "%{@timestamp}" ]
#			add_field => [ "received_from", "%{@source_host}" ]
		}
		syslog_pri { }
		date {
			match => [ "syslog_timestamp", "yyyy:MM:dd-HH:mm:ss" ]
		}
		if "_grokparsefailure" not in [tags] {
			mutate {
				replace => [ "@message", "%{syslog_message}" ]
			}
		}
		mutate {
			remove => [ "syslog_message", "syslog_timestamp" ]
		}
		kv {
			source => "@message"
		}
	}
	if [type] == "eventlog" {
		# Incoming Windows Event logs from nxlog
		# The EventReceivedTime field must contain only digits, or it is an invalid message
#		if [EventReceivedTime] !~ /\d+/ { drop {  } }
#		grep {
#			match => [ "EventReceivedTime", "\d+" ]
#		}
		mutate {
			# Lowercase some values that are always in uppercase
			lowercase => [ "EventType", "FileName", "Hostname", "Severity" ]
		}
		mutate {
			# Set source to what the message says
			rename => [ "Hostname", "@source_host" ]
		}
		date {
			# Convert timestamp from integer in UTC
			match => [ "EventReceivedTime", "UNIX" ]
		}
		mutate {
			# Rename some fields into something more useful
			rename => [ "Message", "@message" ]
			rename => [ "Severity", "eventlog_severity" ]
			rename => [ "SeverityValue", "eventlog_severity_code" ]
			rename => [ "Channel", "eventlog_channel" ]
			rename => [ "SourceName", "eventlog_program" ]
			rename => [ "SourceModuleName", "nxlog_input" ]
			rename => [ "Category", "eventlog_category" ]
			rename => [ "EventID", "eventlog_id" ]
			rename => [ "RecordNumber", "eventlog_record_number" ]
			rename => [ "ProcessID", "eventlog_pid" ]
		}
		mutate {
			# Remove redundant fields
			remove => [ "SourceModuleType", "EventTimeWritten", "EventTime", "EventReceivedTime", "EventType" ]
		}
		if [eventlog_id] == 4624 {
			mutate {
				add_tag => [ "ad-logon-success" ]
			}
		}
		if [eventlog_id] == 4634 {
			mutate {
				add_tag => [ "ad-logoff-success" ]
			}
		}
		if [eventlog_id] == 4771 or [eventlog_id] == 4625 or [eventlog_id] == 4769 {
			mutate {
				add_tag => [ "ad-logon-failure" ]
			}
		}
		if [eventlog_id] == 4723 {
			mutate {
				add_tag => [ "ad-password-change" ]
			}
		}
		if [eventlog_id] == 4724 {
			mutate {
				add_tag => [ "ad-password-reset" ]
			}
		}
		if "ad-logon-success" in [tags] {
			metrics {
				add_tag => [ "drop", "metric", "ad-logon-success" ]
				meter => "ad-logon-success-metric"
			}
		}
		if "ad-logon-failure" in [tags] {
			metrics {
				add_tag => [ "drop", "metric", "ad-logon-failure" ]
				meter => "ad-logon-failure-metric"
			}
		}
	}
	if [type] == "iislog"
	{
		mutate {
			replace => [ "@message", "%{hostname} %{verb} %{fqdn}%{request}%{querystring} %{httpversion} %{status} %{useragent}" ]
			add_field => { "requesturl" => "%{fqdn}%{request}%{querystring}" }
		}
		useragent {
			source => "useragent"
		}
		geoip {
			source => "clientip"
		}
	}
	metrics {
		meter => "events"
		add_tag => [ "drop", "metric", "events-metric" ]
	}
}

output {
	if "drop" not in [tags] {
		elasticsearch { }
#		stdout { codec => rubydebug }
	}
}