gistfile1.txt

local cjson = require "cjson"
-- local dt = require "date_time"

-- {
--    "timestamp": "2009-11-24T21:27:09.534255",
--    "event_type": "alert",
--    "src_ip": "192.168.2.7",
--    "src_port": 1041,
--    "dest_ip": "x.x.250.50",
--    "dest_port": 80,
--    "proto": "TCP",
--    "alert": {
--        "action": "allowed",
--        "gid": 1,
--        "signature_id" :2001999,
--        "rev": 9,
--        "signature": "ET MALWARE BTGrab.com Spyware Downloading Ads",
--        "category": "A Network Trojan was detected",
--        "severity": 1
--    }
-- }

local msg = {
    Type = "suricata_event_log",
    Logger = "nsm",
    Payload = nil,
    Fields = {
        -- Initializing our fields
        ['ts'] = nil,
        ['event_type'] = 'surialert',
        ['flow_id'] = nil,
        ['in_iface'] = nil,
        ['vlan'] = nil,
        ['sourceipaddress'] = nil,
        ['sourceport'] = nil,
        ['destinationipaddress'] = nil,
        ['destinationport'] = nil,
        ['proto'] = nil,
        ['gid'] = nil,
        ['signature_id'] = nil,
        ['rev'] = nil,
        ['signature'] = nil,
        ['category'] = nil,
        ['severity'] = nil,
        ['tx_id'] = nil,
        severity = "INFO",
        category = "suricata_event",
        tags = "nsm,suricata,event"
    }
}

function toString(value)
    if value == "-" then
        return nil
    end
    return value
end

function nilToString(value)
    if value == nil then
        return ""
    end
    return value
end

function toNumber(value)
    if value == "-" then
        return nil
    end
    return tonumber(value)
end

function lastField(value)
    -- remove last "\n" if there's one
    if value ~= nil and string.len(value) > 1 and string.sub(value, -2) == "\n" then
        return string.sub(value, 1, -2)
    end
    return value
end

function process_message(log)
   -- local raw_message = read_message("Payload")
   local raw_message = log
   -- make sure we're getting a valid json input with eye-on-glass decoder ;)
   print("raw json input")
   print(log)
   -- iteration fun
   local ok, json = pcall(cjson.decode, raw_message)
   print("decoded json begins")
   for key, value in pairs(json) do print(key, value) end
   print("decoded json alerts")
   for key, value in pairs(json.alert) do print(key, value) end
   print("decoded json ends")
   -- how to access single fields
   print(json["proto"])
   if not ok then
      return 0 -- when plain text is found, ship it in it's raw form
   end

   -- allows timestamp (optional) to be set within the json "@timestamp" field
   -- useful for output to elasticsearch
   -- if json["@timestamp"] ~= nil then
   --   local ts = lpeg.match(dt.rfc3339, json["@timestamp"])
   --   if not ts then return -1 end

   --   message.Timestamp = dt.time_to_ns(ts)
   --   json["@timestamp"] = nil -- remove the original so it isn't duplicated in Fields
   -- end

   msg.Fields['flow_id'] = toNumber(json['flow_id'])
   msg.Fields['in_iface'] = json['in_iface']
   msg.Fields['vlan'] = toNumber(json['vlan'])
   msg.Fields['sourceipaddress'] = json['src_ip']
   msg.Fields['sourceport'] = toNumber(json['src_port'])
   msg.Fields['destinationipaddress'] = json['dst_ip']
   msg.Fields['destinationport'] = toNumber(json['dst_port'])
   msg.Fields['proto'] = json['proto']
   msg.Fields['gid'] = toNumber(json.alert['gid'])
   msg.Fields['signature_id'] = toNumber(json.alert['signature_id'])
   msg.Fields['rev'] = toNumber(json.alert['rev'])
   msg.Fields['signature'] = json.alert['signature']
   msg.Fields['category'] = json.alert['category']
   msg.Fields['severity'] = json.alert['severity']
   msg.Fields['tx_id'] = toNumber(json.alert['tx_id'])
   -- inject_message(msg)
   return 0
end

for line in io.lines('/Users/mpurzynski/Desktop/lua/eve.json')
do
   process_message(line)
end