Instantly share code, notes, and snippets.

Embed
What would you like to do?
module(load="omelasticsearch")
# this is for index names to be like: logstash-YYYY.MM.DD
template(name="logstash-index" type="list") {
constant(value="logstash-")
property(name="timereported" dateFormat="rfc3339" position.from="1" position.to="4")
constant(value=".")
property(name="timereported" dateFormat="rfc3339" position.from="6" position.to="7")
constant(value=".")
property(name="timereported" dateFormat="rfc3339" position.from="9" position.to="10")
}
# this is for formatting our syslog in JSON with @timestamp
template(name="plain-syslog" type="list") {
constant(value="{")
constant(value="\"@timestamp\":\"") property(name="timereported" dateFormat="rfc3339")
constant(value="\",\"@host\":\"") property(name="hostname")
constant(value="\",\"@fromhost-ip\":\"") property(name="fromhost-ip")
constant(value="\",\"@severity\":\"") property(name="syslogseverity-text")
constant(value="\",\"@facility\":\"") property(name="syslogfacility-text")
constant(value="\",\"@syslogtag\":\"") property(name="syslogtag" format="json")
constant(value="\",\"@message\":\"") property(name="msg" format="json")
constant(value="\"}")
}
# Another ERB-fied version that's functional, but hard to read.
module(load="omudpspoof")
module(load="omelasticsearch")
template(name="udp_to_long_term" type="string" string="%rawmsg%")
template(name="to_elasticsearch_json" type="string" string="{%msg:::jsonf:@message%,%fromhost:::jsonf:@fromhost%,%syslogfacility-text:::,jsonf:@facility%,%syslogpriority-text:::jsonf:@priority%,%timereported:::date-rfc3339,jsonf:@timestamp%}")
template(name="search_index"
type="string"
string="riot_rsyslog-%timereported:1:10:date-rfc3339%"
)
ruleset(name="<%= @rsyslog_protocol %>-<%= @rsyslog_port %>"){
action(type="omudpspoof"
target="<%= @long_term_server %>"
template="udp_to_long_term"
)
action(type="omelasticsearch"
template="to_elasticsearch_json"
searchIndex="search_index"
server="<%= @elasticsearch_server %>"
serverport="<%= @elasticsearch_port %>"
dynSearchIndex="on"
<% if @elasticsearch_debug == true %>
<%=errorFile="/var/log/es-error.log" %>
<% end %>
)
}
input(type="imudp" port="<%= @rsyslog_port %>" ruleset="<%= @rsyslog_protocol %>-<%= @rsyslog_port %>")
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment