Enrich port data with a new description field

[Duked]

Hi all,

I'm parsing logs that contains src/dst port information. Now for every port I want to enrich the data by adding a description field. To make it clear:

• Port 22 -> description = "SSH Traffic"
• Port 80 -> description = "HTTP Traffic"
• Port 33906 -> description = "MySQL"

I think how I could do that manually with mutate. But ideally I'd like to either load a csv file (port,description) and do the matching automatically or is there anything that already does that so I don't reinvent the wheel.

[pastechecker (Charlie)]

@Duked

g logs that contains src/dst port information. Now for every port I want to enrich the data by adding a description field. To m

You can use the translate plugin.

Eg.

filter {
if [port] {
		translate {
			id => "translate port to description"
			field => "port"
			destination => "port_description"   
			dictionary => [
				"22","SSH Traffic",
				"80","HTTP Traffic",
				"9999","Whatever traffic"
			]
		}
	}
}

if you want it to be externally mapped with a file that you can maintain, do:

filter {
if [port] {
	translate {
			id => "translate port to description"
			field => "port"
			destination => "port_description"   
			dictionary_path => "/etc/logstash/conf.d/lookup_tables/your_ports.json"
			fallback => "didnt_work"
	}
}
}

{"22":"SSH Traffic","80":"HTTP Traffic"}

[Duked]

Awesome thanks a lot for the direction I wasn't aware of the translate plugins.

I'm basically modifying the linux standard port definition in /etc/services but I realize I'll need 2 value to match the description:
"22, TCP: SSH"

Looking at the doc of the plugin this seems to be the correct format:
20 6: ftp-data
21 6: ftp
21 17: fsp
22 6: ssh
23 6: telnet
25 6: smtp
37 6: time
37 17: time

(where 6 is tcp and 17 UDP). I'll test it and make sure it works and I'll update the tag and post the file in case someone might find it useful.

Thanks @pastechecker !