input {
file {
path => "/home/openweb/Documents/dataset/test.json"
start_position => "beginning"
codec => "json"
}}
output {
stdout { codec => rubydebug }
}
/usr/share/logstash/bin/logstash -f /etc/logstash/ conf.d/logstash.conf --path.settings=/etc/logstashecho '{ «name»:«John», «surname»:«Pitt»,«age»:«30», «cars»:[ «Ford», «BMW», «Fiat» ] }' » «/home/opweb/Documents/dataset/test.json»filter {
mutate {
remove_field => [ "@version" ]
add_field => { "tipoUsuario" => "cliente" }
gsub => ["surname", " - ", ""]
}
}
filter{
grok {
match => { "personalInformation" => [ "Information:%{WORD:Name} %{WORD:Surname} %{NUMBER:age} %{NUMBER:height}" ] }
}
}
filter {
if [srcip] and [srcip] != "N/A" {
cidr {
add_tag => ["src_ip_priv"]
address => ["%{srcip}"]
network => ["172.16.0.0/12","10.0.0.0/8","192.168.0.0/16","169.254.0.0/16","0.0.0.0/32"]
}
if "src_ip_priv" not in [tags] {
geoip {
target => "src_geoip"
source => "srcip"
fields => ["city_name", "continent_code","country_code2", "country_code3", "country_name","ip", "latitude", "longitude","location"]
}
}
}
}
/usr/share/logstash/bin/logstash-plugin install logstash-filter-cidr