LogStash proftpd xferlog grok

gistfile1.rb

input {
  file {
    path => "/var/log/xferlog"
    type => "xferlog"
    add_field => { "program" => "proftpd" }
  }
}

filter {
    if [type] == "xferlog" {
      grok {
        match      => [ "message", "(?<time>\w{3} \w{3} \d{2} \d{2}:\d{2}:\d{2} \d{4}) (?<xferTime>\d*) (?<remoteHost>\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b) (?<fileSize>\d*) (?<fileName>\S*) (?<transferType>[a|b]) (?<specialActionFlag>\S{1}) (?<direction>\S{1}) (?<accessMode>\S{1}) (?<userName>\S*) (?<serviceName>\S*) (?<authenticationMethod>\S*) (?<authenticatedUserId>\S*) (?<completionStatus>\S*)" ]
      }

      date {
        match    => [ "time", "EEE MMM dd HH:mm:ss YYYY" ]
        timezone => [ "Europe/London" ]  # Change to your local timezone
      }

      geoip {
        source   => [ "remoteHost" ]
      }

    }
}

Thanks for sharing this

As sometimes day may change it is better to use below grok

      grok {
        match      => [ "message", "(?<time>\w{3} \w{3} (\s\d{1}|\d{2}) \d{2}:\d{2}:\d{2} \d{4}) (?<xferTime>\d*) (?<remoteHost>\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b) (?<fileSize>\d*) (?<fileName>\S*) (?<transferType>[a|b]) (?<specialActionFlag>\S{1}) (?<direction>\S{1}) (?<accessMode>\S{1}) (?<userName>\S*) (?<serviceName>\S*) (?<authenticationMethod>\S*) (?<authenticatedUserId>\S*) (?<completionStatus>\S*)" ]
      }