Hello,
i am using a tool, that uses Elastic search. For retrieving the geolocaton of the IP Address a Json file was created that uses the GeoIP Processor. I updated this file in order to set the geolocation of the private IP Address. But when i restart the system, i get this failure :
Exiting: Error getting pipeline for fileset wazuh/alerts: Error JSON decoding the pipeline file: ingest/pipeline.json: invalid character 'i' looking for beginning of object key string
I think the format the i have used with the IF Else command is not correct. Can someone explain me what is wrong?The code is below. P.S I just used the same IP address for simulatng the case.
{
"description": "Wazuh alerts pipeline",
"processors": [
{ "json" : { "field" : "message", "add_to_root": true } },
{
"geoip": {
"field": "data.srcip",
"target_field": "GeoLocation",
"properties": ["city_name", "country_name", "region_name", "location"],
"ignore_missing": true,
"ignore_failure": true
}
},
{
if [win.eventdata.ipAddress] =~ /^192\.168\./ {
mutate {replace => { "[geoip] [country_name]" => "Austria"} }
}
elseif [win.eventdata.ipAddress] =~ /^192\.168\./ {
mutate {replace => { "[geoip] [city_name]" => "Grebenau"} }
mutate {replace => { "[geoip] [country_name]" => "Germany"} }
}
elseif [win.eventdata.ipAddress] =~ /^192\.168\./{
mutate {replace => { "[geoip] [city_name]" => "Germany-Derching"} }
mutate {replace => { "[geoip] [country_name]" => "Germany-Derching"} }
}
elseif [win.eventdata.ipAddress] =~ /^192\.168\./ or /^193\.170\.72\./ {
mutate {replace => { "[geoip] [city_name]" => "Recklinghausen"} }
mutate {replace => { "[geoip] [country_name]" => "Germany"} }
}
elseif [win.eventdata.ipAddress] =~/^193\.170\.72\./ {
mutate {replace => { "[geoip] [country_name]" => "USA"} }
}
elseif [win.eventdata.ipAddress] =~ /^193\.170\.72\./{
mutate {replace => { "[geoip] [country_name]" => "USA"} }
}
elseif [win.eventdata.ipAddress] =~ /^193\.170\.72\./ {
mutate {replace => { "[geoip] [country_name]" => "USA"} }
}
elseif [win.eventdata.ipAddress] =~ /^193\.170\.72\./ {
mutate {replace => { "[geoip] [country_name]" => "Italy"} }
}
elseif [win.eventdata.ipAddress] =~ /^193\.170\.72\./ {
mutate {replace => { "[geoip] [country_name]" => "United Kingdom"} }
}
elseif [win.eventdata.ipAddress] =~ /^193\.170\.72\.// {
mutate {replace => { "[geoip] [country_name]" => "United Kingdom"} }
}
elseif [win.eventdata.ipAddress] =~ /^193\.170\.72\./ {
mutate {replace => { "[geoip] [country_name]" => "Denmark"} }
}
elseif [win.eventdata.ipAddress] =~ /^193\.170\.72\./ {
mutate {replace => { "[geoip] [country_name]" => "Denmark"} }
}
elseif [win.eventdata.ipAddress] =~ /^193\.170\.72\./ {
mutate {replace => { "[geoip] [country_name]" => "Czech Republic"} }
}
elseif [win.eventdata.ipAddress =~ /^193\.170\.72\./ {
mutate {replace => { "[geoip] [country_name]" => "Czech Republic"} }
}
elseif [win.eventdata.ipAddress] =~ /^193\.170\.72\./ {
mutate {replace => { "[geoip] [country_name]" => "Norway"} }
}
elseif [win.eventdata.ipAddress] =~ /^193\.170\.72\./ {
mutate {replace => { "[geoip] [country_name]" => "Spain"} }
}
elseif [win.eventdata.ipAddress] =~ /^193\.170\.72\./ {
mutate {replace => { "[geoip] [country_name]" => "Spain"} }
}
elseif [win.eventdata.ipAddress] =~ /^193\.170\.72\./ {
mutate {replace => { "[geoip] [country_name]" => "China"} }
}
elseif [win.eventdata.ipAddress] =~ /^193\.170\.72\./ {
mutate {replace => { "[geoip] [country_name]" => "Australia"} }
}
elseif [win.eventdata.ipAddress] =~/^193\.170\.72\./ {
mutate {replace => { "[geoip] [country_name]" => "Australia"} }
}
else {
"geoip": {
"field": "data.win.eventdata.ipAddress",
"target_field": "GeoLocation",
"properties": ["city_name", "country_name", "region_name", "location"],
"ignore_missing": true,
"ignore_failure": true
}
}
},
{
"geoip": {
"field": "data.aws.sourceIPAddress",
"target_field": "GeoLocation",
"properties": ["city_name", "country_name", "region_name", "location"],
"ignore_missing": true,
"ignore_failure": true
}
},
{
"geoip": {
"field": "data.gcp.jsonPayload.sourceIP",
"target_field": "GeoLocation",
"properties": ["city_name", "country_name", "region_name", "location"],
"ignore_missing": true,
"ignore_failure": true
}
},
{
"date": {
"field": "timestamp",
"target_field": "@timestamp",
"formats": ["ISO8601"],
"ignore_failure": false
}
},
{
"date_index_name": {
"field": "timestamp",
"date_rounding": "d",
"index_name_prefix": "{{fields.index_prefix}}",
"index_name_format": "yyyy.MM.dd",
"ignore_failure": false
}
},
{ "remove": { "field": "message", "ignore_missing": true, "ignore_failure": true } },
{ "remove": { "field": "ecs", "ignore_missing": true, "ignore_failure": true } },
{ "remove": { "field": "beat", "ignore_missing": true, "ignore_failure": true } },
{ "remove": { "field": "input_type", "ignore_missing": true, "ignore_failure": true } },
{ "remove": { "field": "tags", "ignore_missing": true, "ignore_failure": true } },
{ "remove": { "field": "count", "ignore_missing": true, "ignore_failure": true } },
{ "remove": { "field": "@version", "ignore_missing": true, "ignore_failure": true } },
{ "remove": { "field": "log", "ignore_missing": true, "ignore_failure": true } },
{ "remove": { "field": "offset", "ignore_missing": true, "ignore_failure": true } },
{ "remove": { "field": "type", "ignore_missing": true, "ignore_failure": true } },
{ "remove": { "field": "host", "ignore_missing": true, "ignore_failure": true } },
{ "remove": { "field": "fields", "ignore_missing": true, "ignore_failure": true } },
{ "remove": { "field": "event", "ignore_missing": true, "ignore_failure": true } },
{ "remove": { "field": "fileset", "ignore_missing": true, "ignore_failure": true } },
{ "remove": { "field": "service", "ignore_missing": true, "ignore_failure": true } }
],
"on_failure" : [{
"drop" : { }
}]
}