If I start Logstash with -f /etc/logstash/conf.d then one of my conf files (windowslogs.conf; whose job it is to read and parse Windows log files forwarded by NXlog on Windows hosts) does not work. Logstash recognizes that lines are being added to the log files because I get _grokParseFail tags, but this is because there is no "message" portion of the entry. But if I start with -f /etc/logstash/conf.d/windowslogs.conf then it reads those Windows log files fine and parses them without problem.
Any ideas? I'm pretty much a Logstash NOOB.
Thanks in advance!!!
Here's an example:
Line in log:
Sep 15 10:25:25 144.17.53.5 {"EventTime": "2015-09-15 10:25:25","Hostname":"BBTSSNOW","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":5156,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":1,"Task":12810,"OpcodeValue":0,"RecordNumber":75370997,"ProcessID":4,"ThreadID":88,"Channel":"Security","Message":"The Windows Filtering Platform has permitted a connection.\r\n\r\nApplication Information:\r\n\tProcess ID:\t\t976\r\n\tApplication Name:\t\device\harddiskvolume2\windows\system32\svchost.exe\r\n\r\nNetwork Information:\r\n\tDirection:\t\tOutbound\r\n\tSource Address:\t\t144.17.53.5\r\n\tSource Port:\t\t55170\r\n\tDestination Address:\t144.17.3.82\r\n\tDestination Port:\t\t53\r\n\tProtocol:\t\t17\r\n\r\nFilter Information:\r\n\tFilter Run-Time ID:\t0\r\n\tLayer Name:\t\tConnect\r\n\tLayer Run-Time ID:\t48","Category":"Filtering Platform Connection","Opcode":"Info","Application":"\device\harddiskvolume2\windows\system32\svchost.exe","Direction":"%%14593","SourceAddress":"144.17.53.5","SourcePort":"55170","DestAddress":"144.17.3.82","DestPort":"53","Protocol":"17","FilterRTID":"0","LayerName":"%%14611","LayerRTID":"48","RemoteUserID":"S-1-0-0","RemoteMachineID":"S-1-0-0","EventReceivedTime":1442334325,"SourceModuleName":"in","SourceModuleType":"im_msvistalog"}#015
What I get from Logstash (using file output, rubydebug) I realize this does not correspond to the log entry as above, just an example:
{"@version":"1","@timestamp":"2015-09-14T22:18:17.316Z","host":"elk.snow.edu","path":"/var/log/hosts/windows/144.17.53.5/user-2015-09-14.log","type":"windows","tags":["windows","_grokParseFailWin1"]}
Here's my grok:
grok {
tag_on_failure => [ "_grokParseFailWin1" ]
match => [ "message", "%{SYSLOGTIMESTAMP:@timestamp} %{SYSLOGHOST:syslog_host} %{JSON:raw_message}%{GREEDYDATA}" ]
}
After the grok I do:
json {
source => "raw_message"
}
Here's JSON in custom patterns (since it's greedy, it will read to the last closing brace)
JSON {.*} (The curly braces are escaped, but this post is stripping them off)