whiskeyalpharomeo

whiskeyalpharomeo / logstash-input-sflowtool

Last active February 7, 2017 05:38

Logstash Input for sFlowtool

	input {
	pipe {
	type => "sflow"
	command => "/usr/local/bin/sflowtool_wrapper.sh -l -p 6343"
	}
	}

whiskeyalpharomeo / logstash-sflowtool-wrapper.sh

Created June 16, 2015 22:32

Logstash Wrapper for sFlowtool

	#!/bin/bash
	#
	# Wrapper script for sflowtool when used in pipe input in logstash.
	# This wrapper script ensures that the sflowtool is not running prior to start of the sflowtool.

	ARGS="$@"
	SFLOWTOOL_PID=$(/bin/ps -ef \| /bin/grep "/usr/bin/sflowtool $ARGS" \| /bin/grep -v "grep" \| /bin/awk ' { print $2 } ')

	if [ ! -z $SFLOWTOOL_PID ]; then
	kill -s 9 $SFLOWTOOL_PID

whiskeyalpharomeo / sflowtool-example-output

Last active May 19, 2016 13:38

Example output from the sflowtool

whiskeyalpharomeo / logstash-tcp-flags-dictionary

Created June 13, 2015 05:38

Logstash TCP Flags YAML Dictionary

whiskeyalpharomeo / logstash-iana-services-dictionary

Created June 13, 2015 05:37

Logstash IANA Services YAML Dictionary

whiskeyalpharomeo / logstash-iana-protocols-dictionary

Created June 13, 2015 05:36

Logstash IANA Protocols YAML Dictionary

whiskeyalpharomeo / logstash-sflow-filter

Last active April 17, 2020 22:27

Logstash Filter for Processing sFlow FLOW records

	#################
	# Sflow Filters #
	#################

	filter {

	if [type] == "sflow" {

	# sFlow sends two kinds of messages - CNTRs and FLOWs
	# I'm not doing anything with CNTRs at this point, so