Nagios Support Forum

Code: Select all

# 
# Logstash Configuration File
# Dynamically created by Nagios Log Server
#
# DO NOT EDIT THIS FILE. IT WILL BE OVERWRITTEN.
#
# Created Fri, 22 Apr 2016 10:41:02 -0400
#

#
# Global inputs
#

input {
    tcp {
        port => 5544
        type => syslog
      }
      udp {
        port => 5544
        type => syslog
      }
    tcp {
        type => 'eventlog'
        port => 3515
        codec => json {
            charset => 'CP1252'
        }
    }
    tcp {
        type => 'import_raw'
        tags => 'import_raw'
        port => 2056
    }
    tcp {
        type => 'import_json'
        tags => 'import_json'
        port => 2057
        codec => json
    }
}

#
# Local inputs
#



#
# Global filters
#

filter {
    if [type] == "syslog" {
        grok {
          match => { "message" => "<%{POSINT:syslog_pri}>%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }
    
        }
         syslog_pri {
        }  
    }
    if [type] == "syslog" {
        grok {
            match => [ "message", "<%{POSINT:SysLogPri}>%{MONTH:Month} %{MONTHDAY:Day} %{TIME:Time} %{GREEDYDATA:FieldThatSaysBit9Server} Bit9 event: text=%{QS:warning} type=%{QS:type} subtype=%{QS:subtype} hostname=%{QS:hostname} username=%{QS:user} date=%{QS:date} ip_address=%{QS:client_ip} process=%{QS:process} file_path=%{QS:path} file_name=%{QS:file} file_hash=%{QS:hash} installer_name=%{QS:installer_exe} policy=%{QS:policy} rule_name=%{QS:rule_name} process_key=%{QS:proc_key} server_version=%{QS:server_ver} file_trust=%{QS:f_trust} file_threat=%{QS:f_threat} process_trust=%{QS:p_trust} process_threat=%{QS:p_threat}" ]
    
        }
    }
}

#
# Local filters
#



#
# Global outputs
#



#
# Local outputs
#

Code: Select all

<%{POSINT:SysLogPri}>