Hi,
i want to build a warning system if there are too many failed logins. I want to index the entries, which appear in auth.log into a new index. I build an index with
input {
file {
path => "/var/log/auth.log"
type => "auth"
}
}
At the end i get all my entries into my index "syslog-auth-log-*".
Now i want to use watcher Index Action, who shall write all index entries into a new index called "anomalies", when i have more than 2 failed logins in the past minute.
My problem is when I have more than 10 failed logins, I no longer get all written in my new index "anomalies". When I produce 10 failed logins with an SSH login script, all 10 entries are displayed in the index "anomalie", when I produce 16 failed logins it just shows 10 entries. Why i lose 6 entries here?
In the execution output it says that it is "total": 16 but it only processes 10 more.
"result": {
"execution_time": "2018-10-05T09:22:08.026Z",
"execution_duration": 4,
"input": {
"type": "search",
"status": "success",
"payload": {
"_shards": {
"total": 10,
"failed": 0,
"successful": 10,
"skipped": 0
},
"hits": {
"hits": [ _hits entries start here_
{
"_index": "logstash-auth-log-2018.10.",
"_type": "doc",
"_source": {
"_index": "logstash-auth-log-2018.10.",
"_type": "doc",
"_source": {
"ssh_client_ip": "10.100.100.111",
"ssh_failreason": "unknown_user",
"@timestamp": "2018-10-05T09:20:35.967Z",
"message": "Failed password for invalid user 9dBrgF from 10.100.100.111 port 48482 ssh2"
}
"_id": "84GIQ2YBncU22ZIzwkoe",
"_score": 0.03707742
],
**"total": 16,** _In the hits entries it just shows me 10 entries, not 16! For a better overview i deleted 9 of them. Where are the other 6?_
"max_score": 0.03707742
},
"took": 1,
"timed_out": false
},
"search": {
"request": {
"search_type": "query_then_fetch",
"indices": [
"logstash-auth-log-*"
],
"types": [],
"body": {
"query": {
"bool": {
"must": {
"match": {
"ssh_failreason": "unknown_user"
}
},
"filter": {
"range": {
"@timestamp": {
"from": "now-2m",
"to": "now"
}
}
}
}
},
"_source": [
"@timestamp",
"ssh_failreason",
"ssh_client_ip",
"message"
]
}
}
}
},
"condition": {
"type": "compare",
"status": "success",
"met": true,
"compare": {
"resolved_values": {
"ctx.payload.hits.total": 16 _I already lost 6 entries_
}
}
},
"transform": {
"type": "script",
"status": "success",
"payload": {
"_value": [
{
"ssh_client_ip": "10.100.100.111",
"@timestamp": "2018-10-05T09:20:35.967Z",
"ssh_failreason": "unknown_user",
"message": "Failed password for invalid user 9dBrgF from 10.100.100.111 port 48482 ssh2"
}
]
}
},
"actions": [
{
"id": "index_payload",
"type": "index",
"status": "success",
"transform": {
"type": "script",
"status": "success",
"payload": {
"_doc": [
{
"ssh_client_ip": "10.100.100.111",
"@timestamp": "2018-10-05T09:20:35.967Z",
"ssh_failreason": "unknown_user",
"message": "Failed password for invalid user 9dBrgF from 10.100.100.111 port 48482 ssh2"
}
]
}
},
"index": {
"response": [
{
"created": true,
"result": "created",
"id": "84GIQ2YBncU22ZIzwkoe",
"version": 1,
"type": "my-type",
"index": "anomalies"
}
]
}
}
]
}
}