Bro ASCII logs in JSON

bro-es.rb

# This logstash config was created for the Logstash 1.5 beta, but I think should work on 1.4.x
# Rename it to .conf, I think. I put .rb for formatting in Gist
input {
  file {
    path => '/nsm/bro/logs/current/*.log'
    codec => "json"
    start_position => "beginning"
    type => "bro"
    
    # The @metadata field is for logstash internal tracking only
    add_field => { "[@metadata][source]" => "bro_files" }
  }
}

filter {
  if [@metadata][source] == "bro_files" {
    # This parses the 'ts' field into @timestamp, but we leave the original ts field as-is for better precision
    date {
      match => ["ts", "ISO8601"]
    }
    # This ruby code just cleans up the filename to get the bro log name
    ruby {
      code => "event['path'] = event['path'].split('/')[-1].split('.')[0]"
    }

  }
}

output {
  if [@metadata][source] == "bro_files" {
    # This is for debug only
    stdout { codec => rubydebug }
    
    # This assumes elasticsearch with default settings on localhost
    elasticsearch { }
  }
}

json.bro

@load tuning/json-logs

redef LogAscii::json_timestamps = JSON::TS_ISO8601;
redef LogAscii::use_json = T;