# Logstash alert type =\>

**URL:** <https://discuss.elastic.co/t/logstash-alert-type/112898>\
**Category:** Logstash\
**Created:** [December 21, 2017, 9:42pm UTC](https://discuss.elastic.co/t/logstash-alert-type/112898 "2017-12-21T21:42:55Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![kunam](https://avatars.discourse-cdn.com/v4/letter/k/3d9bf3/32.png) [@kunam](https://discuss.elastic.co/u/kunam)\
**Post date:** [December 21, 2017, 9:42pm UTC](https://discuss.elastic.co/t/logstash-alert-type/112898/1 "2017-12-21T21:42:55Z")

</div>

Hi,

I'm new to logstash, please bare me and help me in writing this.

How to use logstash alert type in logstash config file. I had a log source called allyourbase and alert type should be mapped to "AllYourBase - Audio Alert " & "AllyourBase\_Block\_DNS\_Sinkhole\_Alert" in logstash filters. How would I do that.

#filter configuration  
} else if [name] == "AllYourBase" {  
mutate {  
add\_field =\> {  
"[fields][logsource]" =\> "allyourbase"  
}

```
}

```

help would be appreciated.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [December 22, 2017, 6:31am UTC](https://discuss.elastic.co/t/logstash-alert-type/112898/2 "2017-12-22T06:31:54Z")

</div>

What does an input event look like? What does an output event (produced by Logstash) look like? What would you like it to look like instead? What does the rest of your Logstash pipeline configuration look like?

---

<div class="post-metadata">

**Author:** ![kunam](https://avatars.discourse-cdn.com/v4/letter/k/3d9bf3/32.png) [@kunam](https://discuss.elastic.co/u/kunam)\
**Post date:** [December 22, 2017, 4:10pm UTC](https://discuss.elastic.co/t/logstash-alert-type/112898/3 "2017-12-22T16:10:05Z")

</div>

Thanks for your reply Magnus Back.

Here is my logstash config file with input, flter and output.

##i need to set an alert type for "allyour base" log source.

lets say {(AllYourBase - Audio") ("AllyourBase\_Block\_DNS\_Sinkhole\_Alert")} these two are part of allyourbase log source.

In output I need to have alerts for following fields. can you please help me in writing this alert tpe in logstash filter

input is ingested through beats and some other ports.

input {  
tcp {  
port =\> 5514  
codec =\> json  
ssl\_enable =\> true  
ssl\_cert =\> "xxxxxx"  
ssl\_key =\> "xxxxxxxxxxxxxx"  
ssl\_verify =\> false  
ssl\_extra\_chain\_certs =\> ["xxxxxxxx"]  
}  
beats {  
port =\> 5044  
ssl =\> true  
ssl\_certificate\_authorities =\> ["xxxxxxxxxxx"]  
ssl\_certificate =\> "xxxxxxxxxx"  
ssl\_key =\> "xxxxxxxxxxx"  
ssl\_verify\_mode =\> "xxxxxxxx"  
}  
}

filter {  
if [fields][logsource] == "activeDirectory" {  
if [event\_data][TargetUserName] {  
mutate {  
add\_field =\> {  
"username" =\> "%{[event\_data][TargetUserName]}"  
}  
}  
} else if [name] == "AllYourBase" {  
mutate {  
add\_field =\> {  
"[fields][logsource]" =\> "allyourbase"  
}

```
}

```

output {  
} if [fields][logsource] == "activedirectory" {  
elasticsearch {  
hosts =\> ["xxxx"]  
user =\> "logstash"  
password =\> "xxx"  
ssl =\> true  
cacert =\> "xxxx"  
ssl\_certificate\_verification =\> false  
index =\> "paloalto-%{+YYYY.MM.dd}"  
}  
} else if [fields][logsource] == "allyourbase" {  
elasticsearch {  
hosts =\> ["xxx"]  
user =\> "logstash"  
password =\> "xxxx"  
ssl =\> true  
cacert =\> "xxxx"  
ssl\_certificate\_verification =\> false  
index =\> "iis-%{+YYYY.MM.dd}"  
}

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [December 22, 2017, 4:13pm UTC](https://discuss.elastic.co/t/logstash-alert-type/112898/4 "2017-12-22T16:13:41Z")

</div>

Okay, that answers the last question. Please also answer these questions:

- What does an input event look like?
- What does an output event (produced by Logstash) look like?
- What would you like it to look like instead?

---

<div class="post-metadata">

**Author:** ![kunam](https://avatars.discourse-cdn.com/v4/letter/k/3d9bf3/32.png) [@kunam](https://discuss.elastic.co/u/kunam)\
**Post date:** [December 26, 2017, 3:14am UTC](https://discuss.elastic.co/t/logstash-alert-type/112898/5 "2017-12-26T03:14:08Z")

</div>

=\>logstash input event is JSON

=\>This is my logstash output, and AllYourbase is my event.  
###RulesMatched:AllYourBase - Audio Alert type:Event version:1.4 lowLevelCategory:Misc Malware isoTimeFormat:yyyy-MM-dd'T'HH:mm:ss.SSSZ destinationIP:172.16.211.134 @timestamp:December 25th 2017, 17:16:42.549 sourceIP:xxx highLevelCategory:Malware payload:\<149\>Dec 25 17:16:41 ODCLNFIRE002 cef[9122]: CEF:0|fireeye|hx|3.1.3|IOC Hit Found|IOC Hit Found|10|rt=Dec 25 2017 23:16:41 UTC host=ODCLNFIRE002 ####

=\>I want to make an alert type for allyourbase event.

hope, I've answered your three questions.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 24, 2018, 10:45pm UTC](https://discuss.elastic.co/t/logstash-alert-type/112898/7 "2018-01-24T22:45:49Z")

</div>

Closed on January 24, 2018, 10:45pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.