grok filter auth.log

grok filter auth.log

filter {
  if [source] == "/var/log/auth.log"{
    grok {
      patterns_dir => "/etc/logstash/patterns"
      match   => ["message", "%{AUTH_LOG_LINE}"]
      add_tag => ["auth_parse"]
    }
    if [program] == "sshd" {
      grok {
        patterns_dir => "/etc/logstash/patterns"
        match   => ["logline", "%{SSH_PUB_LOGIN_S}"]
        add_tag => ["ssh_successful_login", "ssh_pub_login", "ssh_parse"]
      }
      grok {
        patterns_dir => "/etc/logstash/patterns"
        match   => ["logline", "%{SSH_OPEN_SESSION}"]
        add_tag => ["ssh_successful_login", "ssh_open_session", "ssh_parse"]
      }
      grok {
        patterns_dir => "/etc/logstash/patterns"
        match   => ["logline", "%{SSH_CLOSE_SESSION}"]
        add_tag => ["ssh_successful_login", "ssh_close_session", "ssh_parse"]
      }
      grok {
        patterns_dir => "/etc/logstash/patterns"
        match   => ["logline", "%{SSH_PASSWORD_LOGIN_S}"]
      add_tag => ["ssh_successful_login", "ssh_password_login", "ssh_parse"]
      }
      grok {
        patterns_dir => "/etc/logstash/patterns"
        match   => ["logline", "%{SSH_FAILED_LOGIN_S}"]
        add_tag => ["ssh_failed_login", "ssh_parse"]
      }
      grok {
        patterns_dir => "/etc/logstash/patterns"
        match   => ["logline", "%{SSH_ALLOW_USER}"]
        add_tag => ["ssh_failed_login", "ssh_parse"]
      }
      grok {
        patterns_dir => "/etc/logstash/patterns"
        match   => ["logline", "%{SSH_DISCONNECT_S}"]
        add_tag => ["ssh_disconnect", "ssh_parse"]
      }
      grok {
        patterns_dir => "/etc/logstash/patterns"
        match   => ["message", "%{SSH_SNOOPY}"]
        add_tag => ["ssh_snoopy", "ssh_parse"]
      }
      if "ssh_parse" in [tags] {
        mutate {
          remove_tag => ["message", "auth_parse", "ssh_parse", "_grokparsefailure"]
          add_tag => ["security_event"]
        }
      }
  } else if [program] == "sudo" {
      grok {
        patterns_dir => "/etc/logstash/patterns"
        match   => ["logline", "%{SUDO_LOGLINE}"]
        add_tag => ["sudo_parse"]
      } 
      grok {
        patterns_dir => "/etc/logstash/patterns"
        match   => ["logline", "%{SUDO_PROG}"]
        add_tag => ["sudo_parse"]
      } 
      grok {
        patterns_dir => "/etc/logstash/patterns"
        match   => ["logline", "%{SUDO_CLOSE}"]
        add_tag => ["sudo_parse"]
      } 
      if "sudo_parse" in [tags] {
        mutate {
          remove_tag => ["message", "auth_parse", "sudo_parse", "_grokparsefailure"]
          add_tag => ["security_event"]
        }
      }
   } else if [program] == "CRON" {

     }

    date {
      timezone => "Europe/Amsterdam"
      match => ["timestamp", "MMM  d HH:mm:ss", "MMM dd HH:mm:ss", "ISO8601"]
    }
  }
}