Elasticsearch Ingest Pipeline for DNSMasq

dnsmasq-ingest-pipeline

PUT _ingest/pipeline/dnsmasq
{
  "description": "DNSMASQ Log Processor",
  "processors": [
    {
      "dissect": {
        "field": "message",
        "pattern": "%{datetime} dnsmasq[%{?pid}]: %{message_body}"
      }
    },
    {
      "dissect": {
        "if": """ctx.message_body.startsWith("query")""",
        "field": "message_body",
        "pattern": "query[%{query.type}] %{query.what} from %{query.from}"
      }
    },
    {
      "dissect": {
        "if": """ctx.message_body.startsWith("reply")""",
        "field": "message_body",
        "pattern": "reply %{reply.what} is %{reply.is}"
      }
    },
    {
      "dissect": {
        "if": """ctx.message_body.startsWith("forwarded")""",
        "field": "message_body",
        "pattern": "forwarded %{forwarded.what} to %{forwarded.to}"
      }
    },
    {
      "dissect": {
        "if": """ctx.message_body.startsWith("config")""",
        "field": "message_body",
        "pattern": "config %{config.what} is %{config.is}"
      }
    },
    { /* Ensures date has no extra chars */
      "script": {
        "source": "ctx.datetime = ctx.datetime.substring(ctx.datetime.length() - 15);"
      }
    },
    {
      "date": {
        "field": "datetime",
        "target_field": "@timestamp",
        "formats": [
          "MMM dd HH:mm:ss"
        ],
        "timezone": "Europe/Rome"
      }
    },
/*    {
      "remove": {
        "if": "ctx.message_body =~ /^(config|forwarded|reply|query)/",
        "field": [
          "message_body"
        ]
      }
    }, To be used if regex is enabled*/
    {
      "remove": {
        "if": """return (ctx.message_body.startsWith("forwarded") || ctx.message_body.startsWith("query") || ctx.message_body.startsWith("config") || ctx.message_body.startsWith("reply"))""",
        "field": [
          "message_body"
        ]
      }
    },
    {
      "remove": {
        "field": [
          "message",
          "datetime"
        ]
      }
    }
  ]
}