Skip to content

Instantly share code, notes, and snippets.

View sakalajuraj's full-sized avatar

Juraj Sakala sakalajuraj

View GitHub Profile
@sakalajuraj
sakalajuraj / ossec.conf
Created April 16, 2015 19:58
Logstash configuration for ossec logs
# Content of the file /etc/logstash/conf.d/ossec.log
# Logstash is on the same machine as OSSEC.
# Logstash should run with OSSEC group privileges
input {
file {
type => "OSSEC"
path => "/var/ossec/logs/alerts/alerts.log"
codec => multiline {
pattern => "^\*\*"
@sakalajuraj
sakalajuraj / auditd.conf
Last active May 21, 2024 13:51
Logstash configuration for auditd messages received via syslog
# Content of the file /etc/logstash/conf.d/auditd.conf
# Tested on the CentOS 7 auditspd logs forwarded to logstash via rsyslog
input {
syslog {
type => AUDITD
port => xxxx
host => "xxx.xxx.xxx.xxx"
}
}
@sakalajuraj
sakalajuraj / squid.conf
Last active August 1, 2020 00:48
Logstash filter for squid log
# Content of the file /etc/logstash/conf.d/squid.conf
# Squid logs MAC address of the source host
# Logs are sending by syslog-ng raw without standard log headers
input {
tcp {
host => "xxx.xxx.xxx.xxx"
port => xxxx
type => SQUID
tags => [SQUID]