logstash.conf_230306

유입되는 ap 로그 중 grok 패턴을 기존보다 상세히 하여 ap에 로그인한 것과 로그인 실패한 것을 구분

elastalert rule example 참조

- https://dirt-spoon.tistory.com/24

elastalert rules example 1

- https://dirt-spoon.tistory.com/25

elastalert rule example 2

 

 

grok의 pattern_dir에 있는 pattern은 제가 작성했던 pattern을 그대로 사용하시면 됩니다.

 

 

grok 패턴 설명 1

원문	Mar 11 01:48:26 PnP [2357]: pnp_platform.discovery.lease_parser INFO Retrieving lease option strings for vendor-specific-information ipv4
쿼리	%{SYSLOGTIMESTAMP:access_time} %{IPORHOST:ip_or_host} %{IPORHOST:process}\[%{BASE10NUM:process_id}\]\: %{GREEDYDATA:sub_message}

 

grok 패턴 설명 2

원문	Mar 10 17:53:10 192.168.10.2 hostapd[2358]: trying to update accounting statistics, station 5e:70:cb:61:b7:a5 not found
쿼리	%{SYSLOGTIMESTAMP:access_time} %{IPORHOST:ip_or_host} \[%{BASE10NUM:process_id}\]\: %{GREEDYDATA:sub_message}

 

grok 패턴 설명 3

원문	Mar  6 16:15:20 192.168.10.2 syslog: User: admin last logged successfully in 2023-Mar-6#012, to 192.168.10.2, from 192.168.0.54 using HTTPS
쿼리	%{SYSLOGTIMESTAMP:access_time} %{IPORHOST:ip_or_host} %{WORD:process}\: User\: %{GREEDYDATA:user} last logged %{GREEDYDATA:access_result} in %{GREEDYDATA:access_day}\#%{NUMBER:deauthentication_reason_code}, to %{IP:destination_ip}, from %{IP:source_ip} using %{WORD:access_method}

 

grok 패턴 설명 4

원문	Mar  6 16:14:35 192.168.10.2 syslog: User: logon failed for invalid username in 2023-Mar-6#012, to 192.168.10.2, from 192.168.0.54 using HTTPS
쿼리	%{SYSLOGTIMESTAMP:access_time} %{IPORHOST:ip_or_host} %{WORD:process}\: User\: %{GREEDYDATA:reason} in %{GREEDYDATA:access_day}\#%{NUMBER:deauthentication_reason_code}, to %{IP:destination_ip}, from %{IP:source_ip} using %{WORD:access_method}

 

input {
        file {
                path => "/var/log/rsyslog/192.168.10.2/*.log"
                start_position => "beginning"
                tags => ["ap1"]
        }
        file {
                path => "/var/log/rsyslog/192.168.10.3/*.log"
                start_position => "beginning"
                tags => ["ap2"]
        }
        file {
                path => "/var/log/rsyslog/192.168.10.4/*.log"
                start_position => "beginning"
                tags => ["ap3"]
        }
        file {
                path => "/var/log/rsyslog/192.168.10.5/*.log"
                start_position => "beginning"
                tags => ["ap4"]
        }
}

filter {
        if "ap1" in [tags] or "ap2" in [tags] or "ap3" in [tags] or "ap4" in [tags]  {
                grok {
                        patterns_dir => ["/etc/logstash/pattern.d"]
                                match => {
                                        "message" => [
                                                "%{SYSLOGTIMESTAMP:access_time} %{IPORHOST:ip_or_host} %{IPORHOST:process}\[%{BASE10NUM:process_id}\]\: %{GREEDYDATA:sub_message}",
                                                "%{SYSLOGTIMESTAMP:access_time} %{IPORHOST:ip_or_host} \[%{BASE10NUM:process_id}\]\: %{GREEDYDATA:sub_message}",
                                                "%{SYSLOGTIMESTAMP:access_time} %{IPORHOST:ip_or_host} %{WORD:process}\: User\: %{GREEDYDATA:user} last logged %{GREEDYDATA:access_result} in %{GREEDYDATA:access_day}\#%{NUMBER:deauthentication_reason_code}, to %{IP:destination_ip}, from %{IP:source_ip} using %{WORD:access_method}",
                                                "%{SYSLOGTIMESTAMP:access_time} %{IPORHOST:ip_or_host} %{WORD:process}\: User\: %{GREEDYDATA:reason} in %{GREEDYDATA:access_day}\#%{NUMBER:deauthentication_reason_code}, to %{IP:destination_ip}, from %{IP:source_ip} using %{WORD:access_method}"
                                        ]
                                }
                }
                mutate { remove_field => [ "message" ] }
        }
}

output {
        if "ap1" in [tags] {
                elasticsearch {
                        hosts => ["http://192.168.0.17:9200"]
                        index => "logstash-ap1-index-%{+YYYY.MM.dd}"
                }
        }
        else if "ap2" in [tags] {
                elasticsearch {
                        hosts => ["http://192.168.0.17:9200"]
                        index => "logstash-ap2-index-%{+YYYY.MM.dd}"
                }
        }
        else if "ap3" in [tags] {
                elasticsearch {
                        hosts => ["http://192.168.0.17:9200"]
                        index => "logstash-ap3-index-%{+YYYY.MM.dd}"
                }
        }
        else if "ap4" in [tags] {
                elasticsearch {
                        hosts => ["http://192.168.0.17:9200"]
                        index => "logstash-ap4-index-%{+YYYY.MM.dd}"
                }
        }
}