50 lines
1.5 KiB
Plaintext
50 lines
1.5 KiB
Plaintext
# sanitize-simfony-network-log.conf
|
|
|
|
#input { pipeline { address => "sanitize-simfony-netork-log" } }
|
|
|
|
filter {
|
|
|
|
grok {
|
|
patterns_dir => ["/etc/logstash/patterns"]
|
|
match => {
|
|
"log-message" => "IMSI\s*=\s*(%{IMSI:imsi})"
|
|
}
|
|
tag_on_failure => []
|
|
}
|
|
|
|
date {
|
|
match => [ "timestamp", "yyyy-MM-dd HH:mm:ss,SSS", "ISO8601", "EEE MMM dd HH:mm:ss YYY", "EEE MMM d HH:mm:ss YYYY"]
|
|
target => "timestamp"
|
|
}
|
|
|
|
mutate {
|
|
split => ["[host][name]", "."]
|
|
replace => ["[host][name]", "%{[host][name][0]}"]
|
|
rename => { "[host][name]" => "hostname" }
|
|
}
|
|
|
|
mutate {
|
|
remove_field => [ "@timestamp" ]
|
|
remove_field => [ "message" ]
|
|
remove_field => [ "[agent]" ]
|
|
remove_field => [ "[ecs][version]" ]
|
|
remove_field => [ "[host][architecture]" ]
|
|
remove_field => [ "[host][containerized]" ]
|
|
remove_field => [ "[host][hostname]" ]
|
|
remove_field => [ "[host][name]" ]
|
|
remove_field => [ "[host][id]" ]
|
|
remove_field => [ "[host][mac]" ]
|
|
remove_field => [ "[host][os][name]" ]
|
|
remove_field => [ "[host][os][codename]" ]
|
|
remove_field => [ "[host][os][family]" ]
|
|
remove_field => [ "[host][os][kernel]" ]
|
|
remove_field => [ "[host][os][platform]" ]
|
|
remove_field => [ "[host][os][version]" ]
|
|
remove_field => [ "[host][os][family]" ]
|
|
remove_field => [ "[host][os][kernel]" ]
|
|
remove_field => [ "[log][offset]"]
|
|
}
|
|
}
|
|
|
|
#output { pipeline { send_to => "output-simfony-network-log" } }
|