Skip to content

Instantly share code, notes, and snippets.

@peterjgrainger

peterjgrainger/flow-log-parse.txt

Created January 23, 2023 13:14
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save peterjgrainger/edd46237fb28d1db52626582bbc87741 to your computer and use it in GitHub Desktop.
Save peterjgrainger/edd46237fb28d1db52626582bbc87741 to your computer and use it in GitHub Desktop.
Download ZIP
Parse default flow log in log insights
Raw
flow-log-parse.txt
fields @timestamp, @message
| parse @message "* * * * * * * * * * * * * *" as version, account_id, interface_id, srcaddr, dstaddr, srcport, dstport, protocol, packets, bytes, start, end, action, log_status
| filter action = "REJECT"
| sort @timestamp desc
| limit 2000
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment