Skip to content

Commit

Permalink
HTTP status code change to INT instead of POSINT
Browse files Browse the repository at this point in the history
  • Loading branch information
@MarcOverIP
MarcOverIP committed Jul 17, 2020
1 parent 9da4918 commit 1e96e65
Show file tree
Hide file tree
Showing 3 changed files with 6 additions and 6 deletions.
4 changes: 2 additions & 2 deletions elkserver/logstash/conf.d/20-redir-haproxy.conf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -78,12 +78,12 @@ filter {
if "xforwardedfor:-" in [message] {
# Lines without X-Forwarded-For identified with "xforwardedfor:-"
grok {
match => { "messagenosyslog" => [ "GMT:%{HTTPDATE:redirtraffic.timestamp} frontend:(?<redir.frontendname>([^/]*))/(([^/]*))/%{IPORHOST:redir.frontendip}:%{POSINT:redir.frontendport} backend:%{NOTSPACE:redir.backendname} client:%{IPORHOST:redirtraffic.sourceip}:%{POSINT:redirtraffic.sourceport} xforwardedfor:- headers:\{\|(?<redirtraffic.headersall>([^\}]*))} statuscode:%{POSINT:redirtraffic.httpstatus} request:%{GREEDYDATA:redirtraffic.httprequest}" ] }
match => { "messagenosyslog" => [ "GMT:%{HTTPDATE:redirtraffic.timestamp} frontend:(?<redir.frontendname>([^/]*))/(([^/]*))/%{IPORHOST:redir.frontendip}:%{POSINT:redir.frontendport} backend:%{NOTSPACE:redir.backendname} client:%{IPORHOST:redirtraffic.sourceip}:%{POSINT:redirtraffic.sourceport} xforwardedfor:- headers:\{\|(?<redirtraffic.headersall>([^\}]*))} statuscode:%{INT:redirtraffic.httpstatus} request:%{GREEDYDATA:redirtraffic.httprequest}" ] }
}
} else if "request:" in [message] {
# Lines with X-Forwarded-For set. We already filtered out the 'xfordwardedfor:-', so anything left with a large enough log line should be good
grok {
match => { "messagenosyslog" => [ "GMT:%{HTTPDATE:redirtraffic.timestamp} frontend:(?<redir.frontendname>([^/]*))/(([^/]*))/%{IPORHOST:redir.frontendip}:%{POSINT:redir.frontendport} backend:%{NOTSPACE:redir.backendname} client:%{IPORHOST:redirtraffic.sourceipcdn}:%{POSINT:redirtraffic.sourceportcdn} xforwardedfor:%{IPORHOST:redirtraffic.sourceip} headers:\{\|(?<redirtraffic.headersall>([^\}]*))} statuscode:%{POSINT:redirtraffic.httpstatus} request:%{GREEDYDATA:redirtraffic.httprequest}" ] }
match => { "messagenosyslog" => [ "GMT:%{HTTPDATE:redirtraffic.timestamp} frontend:(?<redir.frontendname>([^/]*))/(([^/]*))/%{IPORHOST:redir.frontendip}:%{POSINT:redir.frontendport} backend:%{NOTSPACE:redir.backendname} client:%{IPORHOST:redirtraffic.sourceipcdn}:%{POSINT:redirtraffic.sourceportcdn} xforwardedfor:%{IPORHOST:redirtraffic.sourceip} headers:\{\|(?<redirtraffic.headersall>([^\}]*))} statuscode:%{INT:redirtraffic.httpstatus} request:%{GREEDYDATA:redirtraffic.httprequest}" ] }
add_tag => [ "redirtrafficxforwardedfor" ]
}
} else {
Expand Down
4 changes: 2 additions & 2 deletions elkserver/logstash/conf.d/30-redir-apache.conf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -30,12 +30,12 @@ filter {
if "xforwardedfor:-" in [message] {
# Lines without X-Forwarded-For identified with "xforwardedfor:-"
grok {
match => { "messagenosyslog" => [ "frontend:(?<redir.frontendname>([^/]*))/%{IPORHOST:redir.frontendip}:%{POSINT:redir.frontendport} backend:%{NOTSPACE:redir.backendname} client:%{IPORHOST:redirtraffic.sourceip}:%{POSINT:redirtraffic.sourceport} xforwardedfor:- headers:\{(?<redirtraffic.headersall>([^\}]*))} statuscode:%{POSINT:redirtraffic.httpstatus} request:%{GREEDYDATA:redirtraffic.httprequest}" ] }
match => { "messagenosyslog" => [ "frontend:(?<redir.frontendname>([^/]*))/%{IPORHOST:redir.frontendip}:%{POSINT:redir.frontendport} backend:%{NOTSPACE:redir.backendname} client:%{IPORHOST:redirtraffic.sourceip}:%{POSINT:redirtraffic.sourceport} xforwardedfor:- headers:\{(?<redirtraffic.headersall>([^\}]*))} statuscode:%{INT:redirtraffic.httpstatus} request:%{GREEDYDATA:redirtraffic.httprequest}" ] }
}
} else if "request:" in [message] {
# Lines with X-Forwarded-For set. We already filtered out the 'xfordwardedfor:-', so anything left with a large enough log line should be good
grok {
match => { "messagenosyslog" => [ "frontend:(?<redir.frontendname>([^/]*))/%{IPORHOST:redir.frontendip}:%{POSINT:redir.frontendport} backend:%{NOTSPACE:redir.backendname} client:%{IPORHOST:redirtraffic.sourceipcdn}:%{POSINT:redirtraffic.sourceportcdn} xforwardedfor:%{IPORHOST:redirtraffic.sourceip} headers:\{(?<redirtraffic.headersall>([^\}]*))} statuscode:%{POSINT:redirtraffic.httpstatus} request:%{GREEDYDATA:redirtraffic.httprequest}" ] }
match => { "messagenosyslog" => [ "frontend:(?<redir.frontendname>([^/]*))/%{IPORHOST:redir.frontendip}:%{POSINT:redir.frontendport} backend:%{NOTSPACE:redir.backendname} client:%{IPORHOST:redirtraffic.sourceipcdn}:%{POSINT:redirtraffic.sourceportcdn} xforwardedfor:%{IPORHOST:redirtraffic.sourceip} headers:\{(?<redirtraffic.headersall>([^\}]*))} statuscode:%{INT:redirtraffic.httpstatus} request:%{GREEDYDATA:redirtraffic.httprequest}" ] }
add_tag => [ "redirtrafficxforwardedfor" ]
}
} else {
Expand Down
4 changes: 2 additions & 2 deletions elkserver/logstash/conf.d/40-redir-nginx.conf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -30,12 +30,12 @@ filter {
if "xforwardedfor:-" in [message] {
# Lines without X-Forwarded-For identified with "xforwardedfor:-"
grok {
match => { "messagenosyslog" => [ "frontend:(?<redir.frontendname>([^/]*))/%{IPORHOST:redir.frontendip}:%{POSINT:redir.frontendport} backend:%{NOTSPACE:redir.backendname} client:%{IPORHOST:redirtraffic.sourceip}:%{POSINT:redirtraffic.sourceport} xforwardedfor:- headers:\{(?<redirtraffic.headersall>([^\}]*))} statuscode:%{POSINT:redirtraffic.httpstatus} request:%{GREEDYDATA:redirtraffic.httprequest}" ] }
match => { "messagenosyslog" => [ "frontend:(?<redir.frontendname>([^/]*))/%{IPORHOST:redir.frontendip}:%{POSINT:redir.frontendport} backend:%{NOTSPACE:redir.backendname} client:%{IPORHOST:redirtraffic.sourceip}:%{POSINT:redirtraffic.sourceport} xforwardedfor:- headers:\{(?<redirtraffic.headersall>([^\}]*))} statuscode:%{INT:redirtraffic.httpstatus} request:%{GREEDYDATA:redirtraffic.httprequest}" ] }
}
} else if "request:" in [message] {
# Lines with X-Forwarded-For set. We already filtered out the 'xfordwardedfor:-', so anything left with a large enough log line should be good
grok {
match => { "messagenosyslog" => [ "frontend:(?<redir.frontendname>([^/]*))/%{IPORHOST:redir.frontendip}:%{POSINT:redir.frontendport} backend:%{NOTSPACE:redir.backendname} client:%{IPORHOST:redirtraffic.sourceipcdn}:%{POSINT:redirtraffic.sourceportcdn} xforwardedfor:%{IPORHOST:redirtraffic.sourceip} headers:\{(?<redirtraffic.headersall>([^\}]*))} statuscode:%{POSINT:redirtraffic.httpstatus} request:%{GREEDYDATA:redirtraffic.httprequest}" ] }
match => { "messagenosyslog" => [ "frontend:(?<redir.frontendname>([^/]*))/%{IPORHOST:redir.frontendip}:%{POSINT:redir.frontendport} backend:%{NOTSPACE:redir.backendname} client:%{IPORHOST:redirtraffic.sourceipcdn}:%{POSINT:redirtraffic.sourceportcdn} xforwardedfor:%{IPORHOST:redirtraffic.sourceip} headers:\{(?<redirtraffic.headersall>([^\}]*))} statuscode:%{INT:redirtraffic.httpstatus} request:%{GREEDYDATA:redirtraffic.httprequest}" ] }
add_tag => [ "redirtrafficxforwardedfor" ]
}
} else {
Expand Down

0 comments on commit 1e96e65

Please sign in to comment.