roycepope

<W>%{TIMESTAMP_ISO8601:timestamp}%{SPACE}1%{SPACE}=>%{SPACE}<%{NUMBER:id}:\(-1\)>%{SPACE}New%{SPACE}connection:%{SPACE}%{IP:clientip}:%{BASE10NUM:port}

roycepope

filter {
  if [type] == "apache" {
    grok {
      match => { "message" => "%{COMBINEDAPACHELOG}" }
    }
    geoip {
      source => "clientip"
      target => "geoip"
      database => "/etc/logstash/GeoLiteCity.dat"
      add_field => [ "[geoip][coordinates]", "%{[geoip][longitude]}" ]

roycepope

filter {
  if [type] == "mumble" {
    grok {
      match => { "message" => "<W>%{TIMESTAMP_ISO8601:timestamp}%{SPACE}1%{SPACE}=>%{SPACE}<%{NUMBER:id}:\(-1\)>%{SPACE}New%{SPACE}connection:%{SPACE}%{IP:clientip}:%{BASE10NUM:port}" }
    }
    geoip {
      source => "clientip"
      target => "geoip"
      database => "/etc/logstash/GeoLiteCity.dat"
      add_field => [ "[geoip][coordinates]", "%{[geoip][longitude]}" ]

roycepope

#!/usr/bin/env python
# simple encryption/archival tool
# tar and gpg encrypt a file or directory and copy it locally
# the local destination could be a remote share or rsync'd location

import argparse
import sys
import os
import datetime