Echo ingest playground

playground

#!/bin/sh

docker run -it --rm --name playground-ingest -v $(pwd)/sample.conf:/config-dir/logstash.conf registry.echo-security.co/joola/echo-collector:6.0 -f /config-dir/logstash.conf

sample.conf

input {
  stdin {
  }
}
filter {
  grok {
    match => { "message" => "%{SYSLOGTIMESTAMP:timestamp} %{SYSLOGHOST:host_name}/%{SYSLOGHOST:host_ip} %{GREEDYDATA:message}" }
    overwrite => ["message"]
  } 
  if [host_name] == 'localhost' {
  }
  else {
    kv {
      source => "message"
    }
  }
 
  if [srcip] {
    geoip {
      source => "srcip"
      target => "srcip_geoip"
    }
  }
  if [dstip] {
    geoip {
      source => "dstip"
      target => "dstip_geoip"
    }
  }
}
output {
  stdout {
    codec => rubydebug
  }
}