Skip to content

Instantly share code, notes, and snippets.

@whiskeyalpharomeo
whiskeyalpharomeo / logstash-sflow-filter
Last active April 17, 2020 22:27
Logstash Filter for Processing sFlow FLOW records
#################
# Sflow Filters #
#################
filter {
if [type] == "sflow" {
# sFlow sends two kinds of messages - CNTRs and FLOWs
# I'm not doing anything with CNTRs at this point, so
@whiskeyalpharomeo
whiskeyalpharomeo / logstash-iana-protocols-dictionary
Created June 13, 2015 05:36
Logstash IANA Protocols YAML Dictionary
"0": HOPOPT
"1": ICMP
"2": IGMP
"3": GGP
"4": IPv4
"5": ST
"6": TCP
"7": CBT
"8": EGP
"9": IGP
@whiskeyalpharomeo
whiskeyalpharomeo / logstash-iana-services-dictionary
Created June 13, 2015 05:37
Logstash IANA Services YAML Dictionary
"1": tcpmux
"2": nbp
"4": echo
"6": zip
"7": echo
"9": discard
"11": systat
"13": daytime
"15": netstat
"17": qotd
@whiskeyalpharomeo
whiskeyalpharomeo / logstash-tcp-flags-dictionary
Created June 13, 2015 05:38
Logstash TCP Flags YAML Dictionary
"0x00": NULL
"0x01": FIN
"0x02": SYN
"0x03": FIN-SYN
"0x08": PSH
"0x09": FIN-PSH
"0x0A": SYN-PSH
"0x0B": FIN-SYN-PSH
"0x10": ACK
"0x11": FIN-ACK
@whiskeyalpharomeo
whiskeyalpharomeo / sflowtool-example-output
Last active May 19, 2016 13:38
Example output from the sflowtool
startDatagram =================================
datagramSourceIP 10.xx.xx.42
datagramSize 185
unixSecondsUTC 1432059370
datagramVersion 5
agentSubId 0
agent 10.xx.xx.12
packetSequenceNo 3861
sysUpTime 11722000
samplesInPacket 1
@whiskeyalpharomeo
whiskeyalpharomeo / logstash-sflowtool-wrapper.sh
Created June 16, 2015 22:32
Logstash Wrapper for sFlowtool
#!/bin/bash
#
# Wrapper script for sflowtool when used in pipe input in logstash.
# This wrapper script ensures that the sflowtool is not running prior to start of the sflowtool.
ARGS="$@"
SFLOWTOOL_PID=$(/bin/ps -ef | /bin/grep "/usr/bin/sflowtool $ARGS" | /bin/grep -v "grep" | /bin/awk ' { print $2 } ')
if [ ! -z $SFLOWTOOL_PID ]; then
kill -s 9 $SFLOWTOOL_PID
@whiskeyalpharomeo
whiskeyalpharomeo / logstash-input-sflowtool
Last active February 7, 2017 05:38
Logstash Input for sFlowtool
input {
pipe {
type => "sflow"
command => "/usr/local/bin/sflowtool_wrapper.sh -l -p 6343"
}
}