winevent-logstash

winevent-logstash.conf

# capture windows events over JSON
# expects to be sent by the NXLOG package
# author: Joff Thyer, 2017
input {
    tcp {
        port   => 3515
        codec  => json
    }
}

filter {
    # multiple conditions could occur with timestamps
    # (1) UtcTime field exists and is populated
    # (2) UtcTime is contained within "Message" field
    # (3) UtcTime field does not exist and is not in "Message" field

    if "Microsoft-Windows-Sysmon" in [SourceName] {

        grok {
            match => {
                "Message" => "^(?<SysmonEventType>[A-Za-z\s]+):\s"
            }
        }

        grok {
            match => {
                "Message" =>
"(?m)UtcTime:\s([0-9]{4}-[0-9]{2}-[0-9]{2}\s[0-9]{2}:[0-9]{2}:[0-9]{2}\.[0-9]{3})"
            }
        }

    }
    date {
        match => [ "UtcTime", "yyyy-MM-dd HH:mm:ss.SSS" ]
        timezone => "UTC"
    }
    if "_dateparsefailure" in [tags] {
        # worst possible time granuality result
        date {
            match => [ "EventTime", "yyyy-MM-dd HH:mm:ss" ]
            timezone => "America/New_York"
        }
    }

    #mutate { remove_tag => [ "_dateparsefailure" ] }
    #mutate { remove_tag => [ "_grokparsefailure" ] }
}

output {
    elasticsearch {
        hosts => [ "127.0.0.1:9200" ]
        index => "winevent-%{+YYYY.MM.dd}"
    }
    #stdout { codec => rubydebug }
}