-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy path12-apache.conf
53 lines (49 loc) · 3.7 KB
/
12-apache.conf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
filter {
if [type] == "apache-access" or [type] == "apache" {
grok {
match => { "message" => "%{UUID:request_uuid} %{IP:client_ip} - %{IP:client_ip} - - \[%{HTTPDATE:timestamp}\] \"%{WORD:method} %{URIPATH:request_page}(?:%{URIPARAM:params})? HTTP/%{NUMBER:http_version}\" %{NUMBER:server_response:int} %{NUMBER:bytes_sent:float} %{NUMBER:time_taken:float} %{QUOTEDSTRING:referrer} %{QUOTEDSTRING:useragent}" }
match => { "message" => "%{UUID:request_uuid} %{IP:client_ip} - - \[%{HTTPDATE:timestamp}\] \"%{WORD:method} %{URIPATH:request_page}(?:%{URIPARAM:params})? HTTP/%{NUMBER:http_version}\" %{NUMBER:server_response:int} %{NUMBER:bytes_sent:float} %{NUMBER:time_taken:float} %{QUOTEDSTRING:referrer} %{QUOTEDSTRING:useragent}" }
match => { "message" => "%{UUID:request_uuid} %{IP:client_ip} - %{DATA:username} \[%{HTTPDATE:timestamp}\] \"%{WORD:method} %{URIPATH:request_page}(?:%{URIPARAM:params})? HTTP/%{NUMBER:http_version}\" %{NUMBER:server_response:int} %{NUMBER:bytes_sent:float} %{NUMBER:time_taken:float} %{QUOTEDSTRING:referrer} %{QUOTEDSTRING:useragent}" }
match => { "message" => "%{IP:client_ip} - %{IP:client_ip} - - \[%{HTTPDATE:timestamp}\] \"%{WORD:method} %{URIPATH:request_page}(?:%{URIPARAM:params})? HTTP/%{NUMBER:http_version}\" %{NUMBER:server_response:int} %{NUMBER:bytes_sent:float} %{NUMBER:time_taken:float} %{QUOTEDSTRING:referrer} %{QUOTEDSTRING:useragent}" }
match => { "message" => "%{IP:client_ip} - - \[%{HTTPDATE:timestamp}\] \"%{WORD:method} %{URIPATH:request_page}(?:%{URIPARAM:params})? HTTP/%{NUMBER:http_version}\" %{NUMBER:server_response:int} %{NUMBER:bytes_sent:float} %{NUMBER:time_taken:float} %{QUOTEDSTRING:referrer} %{QUOTEDSTRING:useragent}" }
match => { "message" => "%{IP:client_ip} - %{DATA:username} \[%{HTTPDATE:timestamp}\] \"%{WORD:method} %{URIPATH:request_page}(?:%{URIPARAM:params})? HTTP/%{NUMBER:http_version}\" %{NUMBER:server_response:int} %{NUMBER:bytes_sent:float} %{NUMBER:time_taken:float} %{QUOTEDSTRING:referrer} %{QUOTEDSTRING:useragent}" }
match => { "message" => "%{IP:client_ip} - %{IP:client_ip} - - \[%{HTTPDATE:timestamp}\] \"%{WORD:method} %{URIPATH:request_page}(?:%{URIPARAM:params})? HTTP/%{NUMBER:http_version}\" %{NUMBER:server_response:int} %{NUMBER:bytes_sent:float} %{QUOTEDSTRING:referrer} %{QUOTEDSTRING:useragent}" }
match => { "message" => "%{IP:client_ip} - - \[%{HTTPDATE:timestamp}\] \"%{WORD:method} %{URIPATH:request_page}(?:%{URIPARAM:params})? HTTP/%{NUMBER:http_version}\" %{NUMBER:server_response:int} %{NUMBER:bytes_sent:float} %{QUOTEDSTRING:referrer} %{QUOTEDSTRING:useragent}" }
match => { "message" => "%{IP:client_ip} - %{DATA:username} \[%{HTTPDATE:timestamp}\] \"%{WORD:method} %{URIPATH:request_page}(?:%{URIPARAM:params})? HTTP/%{NUMBER:http_version}\" %{NUMBER:server_response:int} %{NUMBER:bytes_sent:float} %{QUOTEDSTRING:referrer} %{QUOTEDSTRING:useragent}" }
}
mutate {
# drop the ? from beginning of params (and elsewhere...)
gsub => ["params", "\?", ""]
}
kv {
field_split => "&"
source => "params"
}
#mutate {
# add_field => { "request_hostname" => "%{client_ip}" }
#}
#dns {
# reverse => [ "request_hostname"]
# add_tag => [ "dns_lookup" ]
# action => "replace"
#}
mutate {
remove_field => [ "password", "password_confirmation", "params", "message" ]
}
geoip {
source => "client_ip"
}
date {
match => [ "timestamp" , "dd/MMM/YYYY:HH:mm:ss Z" ]
timezone => "CET"
}
# mutate {
# add_field => { "request_hostname" => "%{client_ip}" }
# }
# dns {
# reverse => [ "request_hostname"]
# add_tag => [ "dns_lookup" ]
# action => "replace"
# }
}
}