-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy path12-nginx.conf
41 lines (38 loc) · 2.36 KB
/
12-nginx.conf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
filter {
if [type] == "nginx-access" {
grok {
match => { "message" => "- %{IP:client_ip} - %{DATA:username} \[%{HTTPDATE:timestamp}\] \"%{WORD:method} %{URIPATH:request_page}%{URIPARAM:params} HTTP/%{NUMBER:http_version}\" %{NUMBER:server_response:int} %{NUMBER:size:float} %{QUOTEDSTRING:referrer} %{QUOTEDSTRING:useragent}" }
match => { "message" => "- %{IP:client_ip} - %{DATA:username} \[%{HTTPDATE:timestamp}\] \"%{WORD:method} %{URIPATH:request_page} HTTP/%{NUMBER:http_version}\" %{NUMBER:server_response:int} %{NUMBER:size:float} %{QUOTEDSTRING:referrer} %{QUOTEDSTRING:useragent}" }
match => { "message" => "%{UUID:request_uuid} %{IP:client_ip} - %{DATA:username} \[%{HTTPDATE:timestamp}\] \"%{WORD:method} %{URIPATH:request_page}%{URIPARAM:params} HTTP/%{NUMBER:http_version}\" %{NUMBER:server_response:int} %{NUMBER:size:float} %{QUOTEDSTRING:referrer} %{QUOTEDSTRING:useragent}" }
match => { "message" => "%{UUID:request_uuid} %{IP:client_ip} - %{DATA:username} \[%{HTTPDATE:timestamp}\] \"%{WORD:method} %{URIPATH:request_page} HTTP/%{NUMBER:http_version}\" %{NUMBER:server_response:int} %{NUMBER:size:float} %{QUOTEDSTRING:referrer} %{QUOTEDSTRING:useragent}" }
match => { "message" => "%{IP:client_ip} - %{DATA:username} \[%{HTTPDATE:timestamp}\] \"%{WORD:method} %{URIPATH:request_page}%{URIPARAM:params} HTTP/%{NUMBER:http_version}\" %{NUMBER:server_response:int} %{NUMBER:size:float} %{QUOTEDSTRING:referrer} %{QUOTEDSTRING:useragent}" }
match => { "message" => "%{IP:client_ip} - %{DATA:username} \[%{HTTPDATE:timestamp}\] \"%{WORD:method} %{URIPATH:request_page} HTTP/%{NUMBER:http_version}\" %{NUMBER:server_response:int} %{NUMBER:size:float} %{QUOTEDSTRING:referrer} %{QUOTEDSTRING:useragent}" }
}
mutate {
# drop the ? from beginning of params (and elsewhere...)
gsub => ["params", "\?", ""]
}
kv {
field_split => "&"
source => "params"
}
mutate {
remove_field => [ "password", "password_confirmation", "params", "message"]
}
geoip {
source => "client_ip"
}
date {
match => [ "timestamp" , "dd/MMM/YYYY:HH:mm:ss Z" ]
timezone => "CET"
}
# mutate {
# add_field => { "request_hostname" => "%{[geoip][longitude]}" }
# }
# dns {
# reverse => [ "request_hostname"]
# add_tag => [ "dns_lookup" ]
# action => "replace"
# }
}
}