logstash tes - openidm openam opendj

logstash for OpenIDM OpenAM OpenDJ

input {
  file {
    type => idmRecon
#    start_position => beginning
    path => "/opt/openidm/audit/recon.csv"
  }
  file {
    type => idmActivity
#    start_position => beginning
    path => "/opt/openidm/audit/activity.csv"
  }
  file {
     type => djAccess
#     start_position => beginning
     path => "/logs/dj/access"
  }
  
  file {
    type => amAccess
#    start_position => beginning
    path => "/logs/am/log/amAuthentication.*"
  }
  
  file {
    type => SAML2
#    start_position => beginning
    path => "/logs/am/log/SAML2.*"
  }
}


filter {
	if [type] == "djAccess" {
             grok {
                match => ["message", 
                       "%{SYSLOG5424SD:timestamp} %{WORD:op} %{WORD:optype} conn=%{POSINT:connid} op=%{POSINT:opnum} msgID=%{POSINT:msgid}"
                ]
             }
             if [op] == "SEARCH" { 
                 drop {}
             }

        }
	if [type] == "idmRecon" {
		csv {
			columns => [
					"idX","action","actionId","ambiguousTargetObjectIds","entryType","message","reconciling","reconId",
					"rootActionId","situation","sourceObjectId","status","targetObjectId","timestamp"
					]

		}
		date {
			match => ["timestamp", "ISO8601"]
		}
	}
	if [type] == "idmActivity" {
		csv {
			columns => [
		       "_id","action","activityId","after","before","changedFields","message","objectId","parentActionid",
		       "passwordChanged","requester","rev","rootActionId","status","timestamp"
			]
		}
		date {
			match => ["timestamp", "ISO8601"]
		}
	}
	if [type] == "amAccess"  {
        csv {
                columns => [time,Data,LoginID,ContextID, IPAddr, LogLevel,
                        Domain, LoggedBy, MessageID, ModuleName, NameID, HostName]
                match => ["message", 
                       "%{SYSLOG5424SD:timestamp} %{WORD:op} %{WORD:optype} conn=%{POSINT:connid} op=%{POSINT:opnum} msgID=%{POSINT:msgid}"
                ]
             }
             if [op] == "SEARCH" { 
                 drop {}
             }

        }
	if [type] == "idmRecon" {
		csv {
			columns => [
					"idX","action","actionId","ambiguousTargetObjectIds","entryType","message","reconciling","reconId",
					"rootActionId","situation","sourceObjectId","status","targetObjectId","timestamp"
					]

		}
		date {
			match => ["timestamp", "ISO8601"]
		}
	}
	if [type] == "idmActivity" {
		csv {
			columns => [
		       "_id","action","activityId","after","before","changedFields","message","objectId","parentActionid",
		       "passwordChanged","requester","rev","rootActionId","status","timestamp"
			]
		}
		date {
			match => ["timestamp", "ISO8601"]
		}
	}
	if [type] == "amAccess"  {
        csv {
                columns => [time,Data,LoginID,ContextID, IPAddr, LogLevel,
                        Domain, LoggedBy, MessageID, ModuleName, NameID, HostName]
                separator => " "
         }
         date {
                        match => ["time", "yyyy-MM-dd HH:mm:ss"]
          }
          geoip { 
             database => "/usr/share/GeoIP/GeoIP.dat"
             source => ["IPAddr"]
          }     
    }
	if [type] == "SAML2"  {
        csv {
                columns => [time,Data,LoginID,ContextID, IPAddr, LogLevel,
                        Domain, LoggedBy, MessageID, ModuleName, NameID, HostName]
                separator => " "
         }
         date {
                        match => ["time", "yyyy-MM-dd HH:mm:ss"]
          }
          geoip { 
             database => "/usr/share/GeoIP/GeoIP.dat"
             source => ["IPAddr"]
          }     
    }
}

output {
  # Use stdout in debug mode again to see what logstash makes of the event.
#  stdout {
#    codec => rubydebug
#  }
  elasticsearch {  host => localhost }
}