This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
{ | |
"title": "VMware", | |
"services": { | |
"query": { | |
"list": { | |
"0": { | |
"query": "*", | |
"alias": "", | |
"color": "#7EB26D", | |
"id": 0, |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
input { | |
file { | |
path => "/var/log/nginx/*access.log" | |
type => "nginx" | |
sincedb_path => "/var/log/.sincedb" | |
} | |
} | |
input { | |
udp { | |
type => "syslog" |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
if "10.0.101.1" in [msgsource_ip] { | |
mutate { | |
add_field => [ "devtype", "JUNIPER" ] | |
add_tag => "JUNIPER" | |
} | |
} | |
if [message] =~ "RT_FLOW_SESSION_CREATE" { | |
if "JUNIPER" in [tags] { | |
mutate { | |
add_tag => "FLOWCREATE" |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
______________________REPLACE BELOW in /etc/logstash.conf__________________ | |
filter { | |
if [type] == "iis" { | |
if [message] =~ "^#" { | |
drop {} | |
} | |
grok { | |
break_on_match => false | |
match => [ | |
"message", "<%{POSINT:syslog_pri}>%{SYSLOGTIMESTAMP} %{WORD:servername} %{TIMESTAMP_ISO8601} %{IP:hostip} %{WORD:method} %{URIPATH:request} (?:%{NOTSPACE:query}|-) %{NUMBER:port} (?:%{NOTSPACE:param}|-) %{IPORHOST:clientip} %{NOTSPACE:agent} %{NUMBER:response} %{NUMBER:subresponse} %{NUMBER:bytes} %{NUMBER:time-taken}", |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
using this nxlog.conf https://gist.github.com/mrlesmithjr/cf212836b9ce162373ed | |
using this logstash.conf https://gist.github.com/mrlesmithjr/72e99caf36fcc2b5d323 | |
My IIS logs being sent from nxlog to logstash is merging multiple IIS log entries into one. Thoughts? | |
{ | |
"_index": "logstash-2014.06.18", | |
"_type": "iis", |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
input { | |
file { | |
path => "/var/log/nginx/access.log" | |
type => "nginx-access" | |
sincedb_path => "/var/log/.nginxaccesssincedb" | |
} | |
} | |
input { | |
file { | |
path => "/var/log/nginx/error.log" |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
input { | |
file { | |
path => "/var/log/nginx/access.log" | |
type => "nginx-access" | |
sincedb_path => "/var/log/.nginxaccesssincedb" | |
} | |
} | |
input { | |
file { | |
path => "/var/log/nginx/error.log" |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
# Add src_ip if not already found | |
filter { | |
if [type] == "syslog" { | |
if [src_ip] == "" { | |
mutate { | |
add_field => [ "src_ip", "%{syslog_hostname}" ] | |
} | |
dns { | |
resolve => [ "src_ip" ] | |
action => "replace" |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#!/bin/sh | |
/usr/local/bin/curator delete --older-than 90 2>&1 | /bin/nc logstash 28778 | |
/usr/local/bin/curator close --older-than 30 2>&1 | /bin/nc logstash 28778 | |
/usr/local/bin/curator bloom --older-than 2 2>&1 | /bin/nc logstash 28778 | |
/usr/local/bin/curator optimize --older-than 2 2>&1 | /bin/nc logstash 28778 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
{ | |
"title": "CollectD", | |
"services": { | |
"query": { | |
"list": { | |
"0": { | |
"query": "*", | |
"alias": "", | |
"color": "#7EB26D", | |
"id": 0, |