Skip to content

Instantly share code, notes, and snippets.

#!/usr/bin/env python
# simple encryption/archival tool
# tar and gpg encrypt a file or directory and copy it locally
# the local destination could be a remote share or rsync'd location
import argparse
import sys
import os
import datetime
@roycepope
roycepope / 13-mumble.conf
Created June 20, 2016 05:27
logstash/conf.d
filter {
if [type] == "mumble" {
grok {
match => { "message" => "<W>%{TIMESTAMP_ISO8601:timestamp}%{SPACE}1%{SPACE}=>%{SPACE}<%{NUMBER:id}:\(-1\)>%{SPACE}New%{SPACE}connection:%{SPACE}%{IP:clientip}:%{BASE10NUM:port}" }
}
geoip {
source => "clientip"
target => "geoip"
database => "/etc/logstash/GeoLiteCity.dat"
add_field => [ "[geoip][coordinates]", "%{[geoip][longitude]}" ]
@roycepope
roycepope / 12-apache.conf
Created June 20, 2016 05:26
logstash/conf.d
filter {
if [type] == "apache" {
grok {
match => { "message" => "%{COMBINEDAPACHELOG}" }
}
geoip {
source => "clientip"
target => "geoip"
database => "/etc/logstash/GeoLiteCity.dat"
add_field => [ "[geoip][coordinates]", "%{[geoip][longitude]}" ]
@roycepope
roycepope / mumble_grok
Created June 20, 2016 04:56
Grok pattern for Mumble client connect
<W>%{TIMESTAMP_ISO8601:timestamp}%{SPACE}1%{SPACE}=>%{SPACE}<%{NUMBER:id}:\(-1\)>%{SPACE}New%{SPACE}connection:%{SPACE}%{IP:clientip}:%{BASE10NUM:port}