logstash for openvpn log

logstash-openvpn.conf

input {
  # dummy data from files
  #file {
  #  path => "D:/dev/elastic5/sample-logs/vpn/messages-*"
  #  start_position => "beginning"
  #}
  
  beats {
    port => 5044
  }
}

filter {
  grok {
    match => {
      "message" => "%{SYSLOGBASE} %{USER:user}/%{IP:source_ip}:%{POSINT:source_port} SENT CONTROL \[%{USER:user1}\]: \'%{DATA:msg}\' \(status=%{INT:status_code}\)"
    }
    remove_field => ["user1"]
    
    match => {
      "message" => "%{SYSLOGBASE} %{IP:source_ip}:%{POSINT:source_port} SENT CONTROL \[%{USER:user}\]: \'%{DATA:msg}\' \(status=%{INT:status_code}\)"
    }
  }
  
  geoip {
    source => "source_ip"
  }

  if [msg] =~ "PUSH_REPLY" {
    mutate {
      replace => { type => "openvpn_access" }
    }
  } 
  
  if [msg] =~ "AUTH_FAILED" {
    mutate {
      replace => { type => "openvpn_err" }
    }
  }
  
  date {
    match => ["timestamp", "MMM dd HH:mm:ss", "MMM  d HH:mm:ss"]
    target => "@timestamp"
  }
 
  if "_grokparsefailure" in [tags] {
    drop { }
  }
}


output {
  # send to elasticsearch
  elasticsearch {
    hosts => ["elasticsearch-host:9200"]
    index => "openvpn-%{+YYYY.MM.dd}"
  }
  # debug
  #stdout { codec => rubydebug }
}