Shroud player data sanitation

shroud-logstash-public.conf

input {
#    stdin { }
#    udp {
#       port => 5959
#       codec => json
#    }
    syslog {
        severity_labels => ["DEBUG", "ERROR", "WARNING", "INFO"]
        host => "127.0.0.1"
        port => 5514
    }
}

filter {
    # drop all NON Location & Eceonomy events.
    if ([message] !~ /(LocationEvent|EconomyEvent)/) {
        drop { }
    }

    # get KV pairs
    kv {
       field_split => ","
       trim_key => " "
    }

    # if player is dev, ignore
    if [Dev] =~ /(True|true)/ {
        drop { }
    }

    # remove specific events
    if [LocationEvent] =~ /(MonsterKilledByMonster|PositionUpdate)/ {
       drop { }
    }

    # remove artifacts and quest items
    if [LocationEvent] =~ /(ItemGained_Loot)/ and "Artifacts" in [Archetype] {
       drop { }
    }

    if [LocationEvent] =~ /(ItemGained_Loot)/ and "PlotRelated" in [Archetype] {
       drop { }
    }

    # match SYSLOG time format
    grok {
         match => { "timestamp" => "%{WORD:month} %{WORD:day} %{WORD:hour}:%{WORD:minute}" }
    }

    # round to the nearest desired interval
    ruby {
         code => "event.set('minute', '%02d' % (((event.get('minute').to_i / 15).to_i)*15).to_s)"
    }

    mutate {
        replace => { "timestamp" => "%{month} %{day} %{hour}:%{minute}:00" }
    }

    date{
        match => [ "timestamp" , "MMM dd HH:mm:ss" ]
        target => "@timestamp"
    }
    
    # if player is marked Anon, sanitize name
    if [PlayerAnon] =~ /True/ and [Victim] and [Victim] in [PlayerName] {
        mutate { replace => { "Victim" => "Anonymous" } }
    }

    # if target is marked Anon, sanitize name
    if [KillerAnon] =~ /True/ and [Killer] {
        mutate { replace => { "Killer" => "Anonymous" } }
    }

    # finally remove the player name and sanitize data fields
    if [PlayerAnon] =~ /True/ {
        mutate { replace => { "PlayerName" => "Anonymous" } }
    }

    # if vendor event, remove player name
    if [VendorEvent] {
        mutate { replace => { "PlayerName" => "Anonymous" } }
    }

    # remove sensitive and unwanted data
    mutate{
        remove_field => [
            "auth", "ident", "message", "IP", "host",
            "@version", "PlayerAnon", "KillerAnon",
            "UserName", "host", "facility", "logsource",
            "program", "priority", "facility_label", "severity"
            #"timestamp"
        ]
    }

    prune{
        whitelist_names => [
            # generic
            "LocationEvent", "PlayerName", "SceneName",
            "xpos", "ypos", "zpos",
            "timestamp", "@timestamp",
            # kills
            "Killer", "Victim",
            # vendor
            "Archetype", "EconomyGoldDelta",
            "Fee", "ItemId", "Price", "PricePerUnit",
            "Quantity", "VendorId", "VendorEvent",
            # economy event
            "EconomyEvent", "GoldValue"
            # temporary
            #,"month", "day", "hour", "minute"
        ]
    }
}

output {
#    stdout { codec => rubydebug }
    elasticsearch {
        hosts => ["localhost:9200"]
        user => <INPUT_USERNAME>
        password => <INPUT_PASSWORD>
    }
}