Offcourse config
input {
udp {
port => 5514
type => syslog
}
tcp {
port => 5514
type => syslog
}
}
filter {
grok {
patterns_dir => ["/etc/logstash/patterns"]
match => ["message", "%{SYSLOG5424PRI:syslog_index}%{GREEDYDATA:message}"]
overwrite => [ "message" ]
tag_on_failure => [ "failure_grok_fortigate" ]
}
kv { }
if [msg] {
mutate {
replace => [ "message", "%{msg}" ]
}
}
mutate {
add_field => ["logTimestamp", "%{date} %{time}"]
add_field => ["loglevel", "%{level}"]
replace => [ "fortigate_type", "%{type}"]
replace => [ "fortigate_subtype", "%{subtype}"]
remove_field => [ "msg", "type", "level", "date", "time" ]
}
date {
locale => "en"
match => ["logTimestamp", "YYYY-MM-dd HH:mm:ss"]
remove_field => ["logTimestamp", "year", "month", "day", "time", "date"]
add_field => ["type", "syslog"]
}
}
output {
elasticsearch { hosts => ["localhost:9200"] index => "logstash-syslog" }
stdout { codec => rubydebug }
}
And debug
[2018-09-26T00:00:00,204][DEBUG][logstash.filters.grok ] Running grok filter {:event=>#<LogStash::Event:0x466511c5>}
[2018-09-26T00:00:00,204][DEBUG][logstash.filters.grok ] Event now: {:event=>#LogStash::Event:0x466511c5}
[2018-09-26T00:00:00,205][DEBUG][logstash.filters.grok ] Running grok filter {:event=>#LogStash::Event:0x3b12fa0a}
[2018-09-26T00:00:00,205][DEBUG][logstash.filters.grok ] Event now: {:event=>#LogStash::Event:0x3b12fa0a}
[2018-09-26T00:00:00,206][DEBUG][logstash.util.decorators ] filters/LogStash::Filters::Mutate: adding value to field {"field"=>"logTimestamp", "value"=>["%{date} %{time}"]}
[2018-09-26T00:00:00,206][DEBUG][logstash.util.decorators ] filters/LogStash::Filters::Mutate: adding value to field {"field"=>"loglevel", "value"=>["%{level}"]}
[2018-09-26T00:00:00,206][DEBUG][logstash.filters.mutate ] filters/LogStash::Filters::Mutate: removing field {:field=>"msg"}
[2018-09-26T00:00:00,206][DEBUG][logstash.filters.mutate ] filters/LogStash::Filters::Mutate: removing field {:field=>"type"}
[2018-09-26T00:00:00,206][DEBUG][logstash.filters.mutate ] filters/LogStash::Filters::Mutate: removing field {:field=>"level"}
[2018-09-26T00:00:00,206][DEBUG][logstash.filters.mutate ] filters/LogStash::Filters::Mutate: removing field {:field=>"date"}
[2018-09-26T00:00:00,206][DEBUG][logstash.filters.mutate ] filters/LogStash::Filters::Mutate: removing field {:field=>"time"}
[2018-09-26T00:00:00,206][DEBUG][logstash.util.decorators ] filters/LogStash::Filters::Mutate: adding value to field {"field"=>"logTimestamp", "value"=>["%{date} %{time}"]}
[2018-09-26T00:00:00,206][DEBUG][logstash.util.decorators ] filters/LogStash::Filters::Mutate: adding value to field {"field"=>"loglevel", "value"=>["%{level}"]}
[2018-09-26T00:00:00,206][DEBUG][logstash.filters.mutate ] filters/LogStash::Filters::Mutate: removing field {:field=>"msg"}
[2018-09-26T00:00:00,206][DEBUG][logstash.filters.mutate ] filters/LogStash::Filters::Mutate: removing field {:field=>"type"}
[2018-09-26T00:00:00,206][DEBUG][logstash.filters.mutate ] filters/LogStash::Filters::Mutate: removing field
{:field=>"level
[2018-09-26T00:00:00,206][DEBUG][logstash.filters.mutate ] filters/LogStash::Filters::Mutate: removing field {:field=>"date"}
[2018-09-26T00:00:00,206][DEBUG][logstash.filters.mutate ] filters/LogStash::Filters::Mutate: removing field {:field=>"time"}
[2018-09-26T00:00:00,206][DEBUG][logstash.util.decorators ] filters/LogStash::Filters: adding value to field {"field"=>"type", "value"=>["syslog"]}
[2018-09-26T00:00:00,206][DEBUG][logstash.filters.date ] filters/LogStash::Filters: removing field {:field=>"logTimestamp"}
[2018-09-26T00:00:00,206][DEBUG][logstash.filters.date ] filters/LogStash::Filters: removing field {:field=>"year"}
[2018-09-26T00:00:00,206][DEBUG][logstash.filters.date ] filters/LogStash::Filters: removing field {:field=>"month"}
[2018-09-26T00:00:00,206][DEBUG][logstash.filters.date ] filters/LogStash::Filters: removing field {:field=>"day"}
[2018-09-26T00:00:00,206][DEBUG][logstash.filters.date ] filters/LogStash::Filters: removing field {:field=>"time"}
[2018-09-26T00:00:00,206][DEBUG][logstash.filters.date ] filters/LogStash::Filters: removing field {:field=>"date"}
[2018-09-26T00:00:00,206][DEBUG][logstash.util.decorators ] filters/LogStash::Filters: adding value to field {"field"=>"type", "value"=>["syslog"]}
[2018-09-26T00:00:00,206][DEBUG][logstash.filters.date ] filters/LogStash::Filters: removing field {:field=>"logTimestamp"}
[2018-09-26T00:00:00,206][DEBUG][logstash.filters.date ] filters/LogStash::Filters: removing field {:field=>"year"}
[2018-09-26T00:00:00,207][DEBUG][logstash.filters.date ] filters/LogStash::Filters: removing field {:field=>"month"}
[2018-09-26T00:00:00,207][DEBUG][logstash.filters.date ] filters/LogStash::Filters: removing field {:field=>"day"}
[2018-09-26T00:00:00,207][DEBUG][logstash.filters.date ] filters/LogStash::Filters: removing field {:field=>"time"}
[2018-09-26T00:00:00,207][DEBUG][logstash.filters.date ] filters/LogStash::Filters: removing field {:field=>"date"}