bash-logging-logstash.conf

input {
    beats {
        port => 5044
    }
}

filter {
  if [infralogtype] == "bash" {
    grok {
      match => { "message" => "^%{SYSLOGTIMESTAMP:syslog_timestamp}\s%{HOSTNAME}\s.+?:\s(?<json_message>.*)$"}
      add_field => [ "received_at", "%{@timestamp}" ]
    }
    date {
      match => [ "syslog_timestamp", "MMM  d HH:mm:ss", "MMM dd HH:mm:ss" ]
    }
    json {
      source => "json_message"
    }
    ruby {
      init => "require 'base64'"
      code => 'event.set("[command]", event.get("b64_command") ? Base64.decode64(event.get("b64_command")) : nil)'
    }
    ruby {
      init => "require 'base64'"
      code => 'event.set("[output]", event.get("b64_output") ? Base64.decode64(event.get("b64_output")) : nil)'
    }
  }
}


output {
  if [infralogtype] == "bash" {
    elasticsearch{
      hosts => ["elasticsearch:9200"]
      user => "elastic"
      password => "changeme"
      sniffing => true
      index => "bash-%{+YYYY.MM.dd}"
    }
  }
}