Skip to content

Instantly share code, notes, and snippets.

@rmrf-run
Last active August 29, 2015 14:07
Show Gist options
  • Save rmrf-run/c7a0364987b2300c9af5 to your computer and use it in GitHub Desktop.
Save rmrf-run/c7a0364987b2300c9af5 to your computer and use it in GitHub Desktop.
partial working grok for sshd syslogs shipped with lumberjack
filter {
if [type] == "syslog" {
grok {
match => { "message" => "%{MONTH:month} %{MONTHDAY:day} %{TIME:time} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}"}
add_field => [ "received_at", "%{@timestamp}" ]
add_field => [ "event_time", "%{time}"]
add_field => [ "received_from", "%{host}" ]
add_field => ["logdate","%{month} %{day} %{time}"]
remove_field => ["month","day", "time"]
remove_field => ["syslog_pid"]
}
if [syslog_program] == "sshd" {
grok {
add_tag => ["sshd"]
remove_tag => ["_grokparsefailure"]
}
if [syslog_program] == "sshd"{
if [event_time] >= "17:30" or [event_time] <= "07:30" {
mutate{ add_tag => ["not_normal_traffic","alert"]}
}
}
if [syslog_hostname] == "***" {
mutate {remove_tag => ["not_normal_traffic","alert"]}
}
if "sshd" not in [tags]{
grok {
patterns_dir => ["/etc/logstash/patterns.d"]
match => ["message", "%{SSHD_FAILED}"]
add_tag => ["sshd","ssh-failed-login"]
remove_tag => ["_grokparsefailure"]
}
}
if "sshd" not in [tags] {
grok {
patterns_dir => ["/etc/logstash/patterns.d"]
match => ["message", "%{SSHD_ACCEPTED}"]
add_tag => ["sshd","accepted-connection"]
tag_on_failure => []
remove_tag => ["_grokparsefailure"]
}
}
if "sshd" not in [tags] {
grok {
patterns_dir => ["/etc/logstash/patterns.d"]
match => ["message", "%{SSHD_INVALID_USER}"]
match => ["message", "%{SSHD_INVALID_USER_AUTH}"]
add_tag => ["sshd","invalid-user"]
tag_on_failure => []
remove_tag => ["_grokparsefailure"]
}
}
# etc ....
# If we didn't match any of the above... we tag it as being unmatched.
if "sshd" not in [tags] {
mutate {
add_tag => ["sshd"]
remove_tag => ["_grokparsefailure"]
}
}
syslog_pri { }
date {
match => [ "syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss" ]
}
}
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment