Skip to content

Instantly share code, notes, and snippets.

@iamhowardtheduck
iamhowardtheduck / plex-mediaserver-networkservicebrowser
Created Jun 1, 2022
plex-mediaserver-networkservicebrowser-INW
View plex-mediaserver-networkservicebrowser
PUT _ingest/pipeline/plex-mediaserver-networkservicebrowser
{
"processors": [
{
"grok": {
"field": "message",
"patterns": [
"(?<event.name>SSDP departed) (?<event.reason>after not being seen for (?<plex.unseen_seconds>\\d+\\.\\d+) seconds)\\: %{IP:client.ip} \\(%{WORD:client.hostname}\\)",
"(?<event.name>SSDP departed) (?<event.reason>after not being seen for (?<plex.unseen_seconds>\\d+\\.\\d+) seconds)\\: %{IP:client.ip} \\((?<client.hostname>[^\\s][^\\(]+) \\(%{IP}\\)\\)",
"(?<event.name>SSDP arrived)\\: %{IP:client.ip} \\(%{WORD:client.hostname}\\)",
@iamhowardtheduck
iamhowardtheduck / plex
Last active Feb 22, 2022
Plex Pipeline
View plex
PUT _ingest/pipeline/plex
{
"processors": [
{
"set": {
"field": "event.module",
"value": "plex",
"ignore_failure": true
}
},
View weathermap.ndjson
{"attributes":{"color":"#06fff7","description":"Weather WMS Feeds: Base radar & warning by county","name":"weather"},"coreMigrationVersion":"7.13.2","id":"a3a75b00-d9c9-11eb-a8e7-7b5dbc36345d","references":[],"type":"tag","updated_at":"2021-06-30T17:36:02.237Z","version":"WzIyMDM0LDNd"}
{"attributes":{"description":"","layerListJSON":"[{\"sourceDescriptor\":{\"type\":\"EMS_TMS\",\"isAutoSelect\":true},\"id\":\"85f9ea6f-e4c6-449c-b9a8-c1af318e0afc\",\"label\":null,\"minZoom\":0,\"maxZoom\":24,\"alpha\":1,\"visible\":true,\"style\":{\"type\":\"TILE\"},\"type\":\"VECTOR_TILE\"},{\"sourceDescriptor\":{\"type\":\"EMS_TMS\",\"id\":\"dark_map\",\"isAutoSelect\":false},\"id\":\"d2d55941-1943-4ab9-b19a-c5b80b1dcc89\",\"label\":\"Road map - Dark\",\"minZoom\":0,\"maxZoom\":24,\"alpha\":1,\"visible\":true,\"style\":{\"type\":\"TILE\"},\"type\":\"VECTOR_TILE\"},{\"sourceDescriptor\":{\"type\":\"WMS\",\"serviceUrl\":\"https://idpgis.ncep.noaa.gov/arcgis/services/NWS_Forecasts_Guidance_Warnings/watch_warn_adv/MapServer/WMS
@iamhowardtheduck
iamhowardtheduck / pfsense ingest pipeline
Last active Jul 18, 2021
pfsense Elastic ECS Compliant Ingest Pipeline for filterlog & openvpn (INW)
View pfsense ingest pipeline
PUT _ingest/pipeline/plex
{
"processors": [
{
"set": {
"field": "event.module",
"value": "plex",
"ignore_failure": true
}
},
@iamhowardtheduck
iamhowardtheduck / fail2ban-ecs-pipeline
Last active May 30, 2021
Fail2Ban ECS Ingest Pipeline
View fail2ban-ecs-pipeline
PUT _ingest/pipeline/fail2ban-ecs
{
"processors": [
{
"grok": {
"field": "message",
"patterns": [
"%{SYSLOGTIMESTAMP:timestamp} %{WORD:host.name} %{GREEDYDATA:message}"
],
"ignore_missing": true,
View telemetry2.0-raw-data-pipeline
PUT _ingest/pipeline/RDK-searchResults-Raw
{
"version": 1,
"processors": [
{
"kv": {
"field": "Report",
"field_split": ",\\{",
"value_split": ":",
"strip_brackets": true,
@iamhowardtheduck
iamhowardtheduck / moloch-ecs
Last active Jan 14, 2021
Moloch ECS Conversion Pipeline
View moloch-ecs
PUT _ingest/pipeline/moloch-ecs
{
"description": "Ingest Moloch indices in ECS format.",
"processors": [
{
"rename": {
"field": "dstIp",
"target_field": "destination.ip",
"description": "DESTINATION IP",
"ignore_missing": true,
@iamhowardtheduck
iamhowardtheduck / gist:c67b65c1652c6508aafcd1da08f0ce30
Created Sep 6, 2020
Zoneminder zmc_m#.log ECS Compliant Ingest Node Pipeline Processor
View gist:c67b65c1652c6508aafcd1da08f0ce30
PUT _ingest/pipeline/zoneminder-c
{
"processors": [
{
"dissect": {
"field": "message",
"pattern": "%{Date} %{TimeS} %{zoneminder.camera.id}[%{process.pid}].%{zoneminder.event.type}-zm_monitor.cpp/%{Discard-1} [%{zoneminder.camera.name}: images:%{zoneminder.camera.images} - Capturing at %{zoneminder.camera.fps} fps, capturing bandwidth %{zoneminder.camera.bytes}bytes/sec]",
"ignore_failure": true,
"description": "zoneminder-c FPS & Bytes",
"ignore_missing": true
@iamhowardtheduck
iamhowardtheduck / gist:72f6c5277d45a06d261863510cbc65f0
Created Sep 6, 2020
Zoneminder zma_m#.log ECS Compliant Ingest Node Pipeline Processor
View gist:72f6c5277d45a06d261863510cbc65f0
PUT _ingest/pipeline/zoneminder-a
{
"processors": [
{
"dissect": {
"field": "message",
"pattern": "%{Date} %{TimeS} %{zoneminder.camera.id}[%{process.pid}].%{zoneminder.event.type}-zm_monitor.cpp/%{Discard-1} [%{zoneminder.camera.name}: %{Images} - Opening new event %{zoneminder.alarm.id}, section start]",
"ignore_failure": true,
"description": "zoneminder-a New Alert Start",
"ignore_missing": true
@iamhowardtheduck
iamhowardtheduck / pat-status
Created Aug 28, 2020
Index template for Port Authority of Pittsburgh API feed.
View pat-status
PUT _index_template/pat-status
{
"version": 1,
"template": {
"settings": {
"index": {
"lifecycle": {
"name": "PAT-Status",
"rollover_alias": "pat-status"
},