Skip to content

Instantly share code, notes, and snippets.

@dvas0004
Last active Aug 29, 2015
Embed
What would you like to do?
sample logstash configuration file
input {
tcp {
port => 5140
type => "windows-events"
codec => json {
charset => "CP1252"
}
}
tcp {
port => 5141
type => "ossec-events"
codec => json {
charset => "CP1252"
}
}
syslog {
type => "syslog"
}
}
filter {
mutate {
add_field => { "Sender_IP" => "%{host}" }
}
if [type] == "windows-events" {
if [Message] =~ "My first log .*"{
grok {
match => [ "Message", 'My first log %{GREEDYDATA:custom_message}' ]
add_tag => ["grokked"]
}
}
date {
match => ["[EventTime]", "YYYY-MM-dd HH:mm:ss"]
}
}
if [type] == "ossec-events" {
grok {
add_tag => ["AlienVault"]
}
}
}
output {
stdout { }
elasticsearch {
host => "localhost"
template => "/callHome/logstash-1.4.2/lib/logstash/outputs/elasticsearch/elasticsearch-template.json"
template_overwrite => true
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment