logstash-juniper-filter.conf

input {
  tcp {
    port => 514
    type => syslog
  }
  udp {
    port => 514
    type => syslog
  }
}


filter {
        grok {
        match => { "message" => "<%{POSINT:syslog_pri}>%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }
        add_field => [ "received_at", "%{@timestamp}" ]
        add_field => [ "received_from", "%{host}" ]
        }
        syslog_pri { }
                date {
                match => [ "syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss" ]
        }
        if !("_grokparsefailure" in [tags]) {
        mutate {
                replace => [ "@source_host", "%{syslog_hostname}" ]
                replace => [ "@message", "%{syslog_message}" ]
        }
        }
        mutate {
                remove_field => [ "syslog_hostname", "syslog_message", "syslog_timestamp" ]
	}
	
	if [@message] =~ /^APPTRACK/ {
		grok {
		match => { "message" => "%{DATA:apptrack_status} %{IP:SRC_IP}/%{DATA:SRC_PORT}->%{IP:DST_IP}/%{WORD:DST_PORT} %{DATA:APP} %{DATA:APP}UNKNOWN UNKNOWN %{IP:SRC_NAT_IP}/%{DATA:SRC_NAT_PORT}->%{IP:DST_NAT_IP}/%{DATA:DST_NAT_PORT} %{DATA:RULE} None %{NUMBER:PROTO_CODE} %{DATA:RULE_POLICY} %{DATA:SRC_ZONE} %{DATA:DST_ZONE} %{NUMBER:BYTES}" }
		remove_field => [ "@message" ]
		add_tag => ["APPTRACK"]
		}
	}
	if [@message] =~ /^RT_FLOW_SESSION/ {
		grok {
		match => { "message" => "%{DATA:event}: session created %{IP:src_ip}/%{DATA:src_port}->%{IP:dst_ip}/%{DATA:dst_port} %{DATA:src_nat_rule} %{IP:src_nat_ip}/%{DATA:src_nat_port}->%{IP:dst_nat_ip}/%{DATA:dst_nat_port} None None %{INT:protocol_id} %{DATA:policy_name} %{DATA:src_zone} %{DATA:dst_zone} %{INT:session_id}\D+ %{DATA:interface} "}
		add_tag => ["RT_FLOW_SESSION"]
		}
	}
	
	geoip {
      		source => "dst_ip"
      		target => "geoip"
      		database => "/etc/logstash/GeoLiteCity.dat"
      		add_field => [ "[geoip][coordinates]", "%{[geoip][longitude]}" ]
      		add_field => [ "[geoip][coordinates]", "%{[geoip][latitude]}"  ]
    	}		
	
	mutate {
      		convert => [ "[geoip][coordinates]", "float"]
    	}

}
output {
	elasticsearch { hosts => ["localhost:9200"] }
  	stdout { codec => rubydebug }
}