sakalajuraj

# Content of the file /etc/logstash/conf.d/squid.conf
# Squid logs MAC address of the source host
# Logs are sending by syslog-ng raw without standard log headers

input {
  tcp {
        host => "xxx.xxx.xxx.xxx"
        port => xxxx
        type => SQUID
        tags => [SQUID]

sakalajuraj

# Content of the file /etc/logstash/conf.d/auditd.conf
# Tested on the CentOS 7 auditspd logs forwarded to logstash via rsyslog

input {
        syslog {
                type => AUDITD
                port => xxxx
                host => "xxx.xxx.xxx.xxx"
        }
}

sakalajuraj

# Content of the file /etc/logstash/conf.d/ossec.log
# Logstash is on the same machine as OSSEC. 
# Logstash should run with OSSEC group privileges

input {
	 file {
		type => "OSSEC"
		path => "/var/ossec/logs/alerts/alerts.log"
		codec => multiline {
		pattern => "^\*\*"