logstash pipeline for iptables

logstash-iptables.conf

input {
  # dummy data from files
  file {
    path => "D:/dev/sample-logs/iptables/iptables-*"
    start_position => "beginning"
  }
  
  beats {
    port => 5044
  }
}

filter {
  grok {
    # iptables grok patterns
    # https://gist.github.com/Caligatio/1c1ef69dd720186cfacf95c1cd8ea85d
    patterns_dir => ["D:/dev/elastic/logstash/patterns"]
    match => {
      "message" => "%{SYSLOGBASE} %{WORD} Log : %{IPTABLES}"
    }
  }
  
  date {
    match => ["timestamp", "MMM dd HH:mm:ss", "MMM  d HH:mm:ss"]
    target => "@timestamp"
  }
  
  geoip {
    source => "src_ip"
  }

  geoip {
    source => "dest_ip"
  }
  
  
  if "_grokparsefailure" in [tags] {
    drop { }
  }
}


output {
  # send to elasticsearch
  elasticsearch {
    hosts => ["localhost:9200"]
    index => "iptables-%{+YYYY.MM.dd}"
  }
  # debug
  stdout { codec => rubydebug }
}