simple-logstash.conf

simple-logstash.conf

# Input Portion
# Identifies syslog as a syslog type and rando security log

input { 
	file {
	path => "/var/log/syslog"
	type => "syslog"
	}
	file { 
	path => "/opt/logsamp/sec.log"
	type => "security"
	}
 }

# Filter Section
# Filters out Security messages from the sec.log using the grok format and filters out 
# syslog types using a standard syslog format as seen in the logstash documentation
# https://www.elastic.co/guide/en/logstash/current/config-examples.html

filter {
  if [type] == "security" {
    grok {
       match => { "message" => "%{WORD:security_type} %{WORD:sec_program} %{WORD:severity} %{DATA:security_issue}" }
    }
  }
  if [type] == "syslog" {
    grok {
      match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }
      add_field => [ "received_at", "%{@timestamp}" ]
      add_field => [ "received_from", "%{host}" ]
    }
    syslog_pri { }
    date {
      match => [ "syslog_timestamp", "MMM  d HH:mm:ss", "MMM dd HH:mm:ss" ]
    }
  }
}

# Output Section
# Outputs to elasticsearch and to stdout for live viewing/testing.
output {
	elasticsearch { host => localhost }
	stdout { codec => rubydebug }
}