logstash-wing-syslog.conf

logstash-wing-syslog.conf

input {
  tcp {
    port => 514
    type => syslog
  }
  udp {
    port => 514
    type => syslog
  }
}

filter {
  if [type] == "syslog" {
    grok {
      overwrite => "message" match => { "message" => [
        "%{TIMESTAMP_ISO8601:timestamp} %{WORD:device} (\%%{NOTSPACE:program}\:) Client (\'%{NOTSPACE:mac}\') failed %{NOTSPACE} authentication on wlan (\'%{WORD:wlan}\') radio \'(?<location>([a-zA-Z0-9]{4}))",
        "%{TIMESTAMP_ISO8601:timestamp} %{WORD:device} (\%%{NOTSPACE:program}\:) Captive-portal authentication success for client %{MAC:mac}\(%{IP:ip}\) user \'%{WORD:user}",
        "%{TIMESTAMP_ISO8601:timestamp} %{WORD:device} (\%%{NOTSPACE:program}\:) Captive-portal authentication failed for client %{MAC:mac}\(%{IP:ip}\)",
        "%{TIMESTAMP_ISO8601:timestamp} %{WORD:device} (\%%{NOTSPACE:program}\:) Client \'%{MAC:mac}\' denied association on radio \'(?<location>([a-zA-Z0-9]{4}))([^,\]]+)\:%{WORD:radio}",
        "%{TIMESTAMP_ISO8601:timestamp} %{WORD:device} (\%%{NOTSPACE:program}\:) Configuration commit by user \'%{WORD:user}\' (?<description>([^,\]]+)) from \'%{IP:ip}\'",
        "%{TIMESTAMP_ISO8601:timestamp} %{WORD:device} (\%%{NOTSPACE:program}\:) Successfully logged in user \'%{WORD:user}\' with privilege \'%{WORD:user_level}\' from \'%{DATA:connection_method}\'",
        "%{TIMESTAMP_ISO8601:timestamp} %{WORD:device} (\%%{NOTSPACE:program}\:) Log-in failed for user \'%{WORD:user}\' from \'%{DATA:connection_method}\'",
        "%{TIMESTAMP_ISO8601:timestamp} %{WORD:device} (\%%{NOTSPACE:program}\:) UI user \'%{DATA:user}\' from: \'%{DATA:source_ip}\'",
        "%{TIMESTAMP_ISO8601:timestamp} %{WORD:device} (\%%{NOTSPACE:program}\:)",
        "%{SYSLOG5424PRI}%{SYSLOGLINE}"
        ]
      } 
      add_field => [ "received_at", "%{@timestamp}" ]
      add_field => [ "received_from", "%{host}" ]
    }
    
    if ![location] {
      if [device] {
        mutate {
          add_field => { "location" => "%{device}" } 
        }
        
        grok {
          match => [ "location", "(?<fourdigitlocation>([a-zA-Z0-9]{4}))" ]
        }
  
        mutate {
          replace => [ "location", "%{fourdigitlocation}" ]
          remove_field => "fourdigitlocation"
        }
      }
    }
    date {
      match => [ "syslog_timestamp", "MMM  d HH:mm:ss", "MMM dd HH:mm:ss" ]
    }
  }
}

output {
  if [type] == "syslog" and "_grokparsefailure" in [tags] {
    file { path => "C:\\log\\failed_syslog_events-%{+YYYY-MM-dd}" }
  }
  elasticsearch { hosts => ["localhost:9200"] }
  stdout { codec => rubydebug }
}