Private GIT

Skip to content
Snippets Groups Projects
Unverified Commit 0c75cf81 authored by a3ilson's avatar a3ilson Committed by GitHub
Browse files

Delete 10-syslog(test).conf

parent 8d7b7526
No related branches found
No related tags found
No related merge requests found
filter {
if [type] == "syslog" {
#change to pfSense ip address
if [host] =~ /192\.168\.1\.1/ {
mutate {
add_tag => ["PFSense", "Ready"]
}
}
#For Multiple pfSense's, use the following, repeat as needed
# if [host] =~ /192\.168\.100\.1/ {
# mutate {
# add_tag => ["PFSense", "Ready"]
# }
# }
if "Ready" not in [tags] {
mutate {
add_tag => [ "syslog" ]
}
}
}
}
filter {
if [type] == "syslog" {
mutate {
remove_tag => "Ready"
}
}
}
filter {
if "syslog" in [tags] {
grok {
match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }
add_field => [ "received_at", "%{@timestamp}" ]
add_field => [ "received_from", "%{host}" ]
}
syslog_pri { }
date {
match => [ "syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss" ]
locale => "en"
}
if !("_grokparsefailure" in [tags]) {
mutate {
replace => [ "@source_host", "%{syslog_hostname}" ]
replace => [ "@message", "%{syslog_message}" ]
}
}
mutate {
remove_field => [ "syslog_hostname", "syslog_message", "syslog_timestamp" ]
}
# if "_grokparsefailure" in [tags] {
# drop { }
# }
}
}
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment