logstash.conf_230405

fortigate log 파싱 부분이 추가되었습니다.

fortigate 로그 파싱할때에는 logstash-filter-bytes를 사용하였습니다.

이유는 logstash에서 로그를 파싱하면 모든 자료는 기본적으로 type이 text입니다.

마찬가지로 숫자도 text로 인식합니다.

그래서 데이터 전송량도 type에 맞게 bytes라는 필터를 추가로 설치하였습니다.

logstash-filter-bytes의 설치는 아래의 작성 글을 참고하시기 바랍니다.

https://dirt-spoon.tistory.com/80

 

input {
        file {
                path => "/var/log/rsyslog/192.168.10.2/*.log"
                start_position => "beginning"
                tags => ["ap1"]
        }
        file {
                path => "/var/log/rsyslog/192.168.10.3/*.log"
                start_position => "beginning"
                tags => ["ap2"]
        }
        file {
                path => "/var/log/rsyslog/192.168.10.4/*.log"
                start_position => "beginning"
                tags => ["ap3"]
        }
        file {
                path => "/var/log/rsyslog/192.168.10.5/*.log"
                start_position => "beginning"
                tags => ["ap4"]
        }
        file {
                path => "/var/log/rsyslog/192.168.0.14/*.log"
                start_position => "beginning"
                tags => ["fortigate"]
        }
}

filter {
        if "ap1" in [tags] or "ap2" in [tags] or "ap3" in [tags] or "ap4" in [tags]  {
                grok {
                        patterns_dir => ["/etc/logstash/pattern.d"]
                        match => {
                                "message" => [
                                        "%{SYSLOGTIMESTAMP:access_time} %{IPORHOST:ip_or_host} %{IPORHOST:process}\[%{BASE10NUM:process_id}\]\: %{GREEDYDATA:sub_message}",
                                        "%{SYSLOGTIMESTAMP:access_time} %{IPORHOST:ip_or_host} \[%{BASE10NUM:process_id}\]\: %{GREEDYDATA:sub_message}",
                                        "%{SYSLOGTIMESTAMP:access_time} %{IPORHOST:ip_or_host} %{WORD:process}\: User\: %{GREEDYDATA:user} last logged %{GREEDYDATA:access_result} in %{GREEDYDATA:access_day}\#%{NUMBER:deauthentication_reason_code}, to %{IP:destination_ip}, from %{IP:source_ip} using %{WORD:access_method}",
                                        "%{SYSLOGTIMESTAMP:access_time} %{IPORHOST:ip_or_host} %{WORD:process}\: User\: %{GREEDYDATA:reason} in %{GREEDYDATA:access_day}\#%{NUMBER:deauthentication_reason_code}, to %{IP:destination_ip}, from %{IP:source_ip} using %{WORD:access_method}"
                                ]
                        }
                }
                mutate { remove_field => [ "message" ] }
        }
        else if "fortigate" in [tags] {
                grok {
                        patterns_dir => ["/etc/logstash/pattern.d"]
                        match => { "message" => [ "%{FORTILOG} %{GREEDYDATA:sub_message}" ] }
                }
                kv {
                        source => "sub_message"
                        value_split => "="
                }
                mutate { remove_field => [ "message" ] }
                mutate { remove_field => [ "sub_message" ] }
                if "wan" in [srcintfrole] {
                        geoip {
                                source => "srcip"
                                target => "geoip_src"
                        }
                }
                if [sentbyte] != "" and [rcvdbyte] != "" {
                        bytes {
                                source => "rcvdbyte"
                                target => "receivedbyte"
                        }
                        bytes {
                                source => "sentbyte"
                                target => "sentedbyte"
                        }
                }
                mutate {
                        convert => {
                                "rcvdpkt" => "integer"
                                "sentpkt" => "integer"
                                "proto" => "integer"
                                "srcserver" => "integer"
                                "sessionid" => "integer"
                                "duration" => "integer"
                                "policyid" => "integer"
                                "HOUR" => "integer"
                                "MINUTE" => "integer"
                                "SECOND" => "integer"
                        }
                }
        }
}

output {
        if "ap1" in [tags] {
                elasticsearch {
                        hosts => "http://192.168.0.17:9200"
                        index => "logstash-ap1-index-%{+YYYY.MM.dd}"
                }
        }
        else if "ap2" in [tags] {
                elasticsearch {
                        hosts => "http://192.168.0.17:9200"
                        index => "logstash-ap2-index-%{+YYYY.MM.dd}"
                }
        }
        else if "ap3" in [tags] {
                elasticsearch {
                        hosts => "http://192.168.0.17:9200"
                        index => "logstash-ap3-index-%{+YYYY.MM.dd}"
                }
        }
        else if "ap4" in [tags] {
                elasticsearch {
                        hosts => "http://192.168.0.17:9200"
                        index => "logstash-ap4-index-%{+YYYY.MM.dd}"
                }
        }
        else if "fortigate" in [tags] {
                if "traffic" in [LOG_TYPE] {
                        elasticsearch {
                                hosts => "http://192.168.0.17:9200"
                                index => "logstash-fortigate-traffic-index-%{+YYYY.MM.dd}"
                        }
                }
                else if "event" in [LOG_TYPE] {
                        elasticsearch {
                                hosts => "http://192.168.0.17:9200"
                                index => "logstash-fortigate-event-index-%{+YYYY.MM.dd}"
                        }
                }
                else if "utm" in [LOG_TYPE] {
                        elasticsearch {
                                hosts => "http://192.168.0.17:9200"
                                index => "logstash-fortigate-utm-index-%{+YYYY.MM.dd}"
                        }
                }
        }
}