Tombar

# -*- mode: ruby -*-
# vi: set ft=ruby :

# Vagrantfile API/syntax version. Don't touch unless you know what you're doing!
VAGRANTFILE_API_VERSION = "2"

Vagrant.configure(VAGRANTFILE_API_VERSION) do |config|
  # All Vagrant configuration is done here. The most common configuration
  # options are documented and commented below. For a complete reference,
  # please see the online documentation at vagrantup.com.

Tombar

Starting next week, when you register a domain with new contact details, transfer existing domains or
change the registrant (owner) or email address on your contact information, you will receive an
additional email with an activation link. If you don't press this link, your domain will be 
disabled after 15 days.

This is actually required by the new 2013 ICANN contract. Not all registrars are on the new contract 
yet, but those that have already signed are required to start following it as of January.

Link: http://www.icann.org/en/resources/registrars/raa/approved-with-specs-27jun13-en.htm#whois-accuracy

Tombar

  mutate {
    remove_field => ['geoip.areacode', 'geoip.continent_code', 'geoip.country_code3', 'geoip.country_name', 'geoip.dma_code', 
                     'geoip.latitude', 'geoip.longitude', 'geoip.postal_code', 'geoip.real_region_name',
                     'ua.minor', 'ua.major', 'ua.os_minor', 'ua.os_major', 'ua.patch', 'ua.os_name' ]
  }

Tombar

filter {

  ruby {

      code => "# ruby filter to parse and extract postdata multipart encoded into fields

        if event['postdata']['request_body'] =~ /Boundary/

          fields = event['postdata']['request_body'].gsub('x0Dx0Ax0Dx0A', '=')
            .gsub('Content-Disposition: form-data; name=', '')

Tombar

{"host": "examople.com", "remote_addr": "A.B.C.D", "remote_user": "-", "time_local":"04/Dec/2013:21:05:47 +0000", "request": "GET XXXXXX HTTP/1.1", "status":200, "body_bytes_sent": 47322, "http_referer": "http://logstash.net", "http_user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "upstream": {"cache_status":"-", "status": [200], "response_time":[0.302], "addr":"A.B.C.D:80" }, "postdata": {"request_body": "-", "request_length":2963, "request_completion":"OK" },"cookie": {"userid": "-41813428", "param2": "YZY" } }


 35   if [cookie.userid] >= 0 {
 36     mutate { add_field => ['btng_user_logged', 1] }
 37   } else {
 38     mutate { add_field => ['btng_user_logged', 0] }
 39   }
 
 

Tombar

node.override['logstash']['server'].filters = [

  { "json" => {
      "source" => "message"
    }
  },
  { "date" => {
      "match" => [ "time_local", "dd/MMM/YYYY:HH:mm:ss +0000",   "dd/MMM/YYYY:HH:mm:ss"],
      "remove_field" => "time_local"
     }

Tombar

{
   "logstash-2013.11.07":{
      "flat":{
         "properties":{
            "http_user_agent":{
               "type":"string",
               "index":"not_analyzed",
               "store":true,
               "omit_norms":true,
               "index_options":"docs"

Tombar

  grok {
    tags    => "postfix/smtpd"
    pattern => [  "%{POSTFIXSMTPDCONNECTS}",
                  "%{POSTFIXSMTPDACTIONS}",
                  "%{POSTFIXSMTPDTIMEOUTS}",
                  "%{POSTFIXSMTPDLOGIN}",
                  "." ]
    named_captures_only => true
  }

Tombar

# Postfix stuff
QUEUEID (?:[A-F0-9]+|NOQUEUE)
EMAILADDRESSPART [a-zA-Z0-9_.+-=:]+
EMAILADDRESS %{EMAILADDRESSPART:local}@%{EMAILADDRESSPART:remote}
RELAY (?:%{HOSTNAME:relayhost}(?:\[%{IP:relayip}\](?::[0-9]+(.[0-9]+)?)?)?)
#RELAY (?:%{HOSTNAME:relayhost}(?:\[%{IP:relayip}\](?:%{POSREAL:relayport})))
POSREAL [0-9]+(.[0-9]+)?
#DELAYS %{POSREAL:a}/%{POSREAL:b}/%{POSREAL:c}/%{POSREAL:d}
DELAYS (%{POSREAL}[/]*)+
DSN %{NONNEGINT}.%{NONNEGINT}.%{NONNEGINT}

Tombar

# on the db

mysql> select id, display_name, email, lower(concat(replace(display_name, ' ', ''), id)) as clave_nueva from UserData_userprofile;

| 189 | Moe            |                               | moe189            |
| 190 | Larry          |                               | larry190          |
| 191 | Curly          |                               | curly191          |

# on the admin