testinetsim.py

#!/usr/bin/python
# -*- coding: utf-8 -*-
#
# Quick hack to convert inetsim.org logs to json for easy parsing in ELK
#
# Author: @jovimon

import datetime
import json

entries = {}

f = open('service.log', 'r')
contents = f.readlines()

for linea in contents:
  linea = linea.strip()
  ldate,lhour,lpid,lproto,lconn_id,lsrc_ip,ldata = linea.split(' ', 6)
  date = datetime.datetime.strptime(ldate[1:] + lhour[:-1], "%Y-%m-%d%H:%M:%S")
  pid = int(lpid[1:-1])
  proto = "HTTP" if lproto.startswith('[http') else "FTP" if lproto.startswith('[ftp') else "DNS" if lproto.startswith('[dns') else "OTHER"
  conn = int(lconn_id[1:-1])
  src_ip = lsrc_ip[1:-1]
  data = ldata.strip()
  mykey = "%d_%s_%d" % (pid, proto, conn)
  if mykey not in entries:
    entries[mykey] = {'date': date.strftime("%Y-%m-%d %H:%M:%S"), 'pid': pid, 'protocolo': proto, 'conn_id': conn, 'src_ip': src_ip, 'data': [data]}
  else:
    existing = entries[mykey]
    existing['data'].append(data)
    if data.find('disconnect') > -1:
      # Pretty printing
      #print json.dumps(existing, indent=4, separators=(',', ': '))
      # Normal printing
      print json.dumps(existing)
      entries.pop(mykey, None)