bro.conf

# Created by Terrence Gareau "tuna" for honeypot project
# tuna@people.ops-trust.net

# Used Jason Smith's setup as a base 
# Great Blog post http://www.appliednsm.com/parsing-bro-logs-with-logstash/
# http://blog.lusis.org/blog/2012/01/31/load-balancing-logstash-with-amqp/
# tuna@people.ops-trust.net
# https://home.regit.org/2014/01/a-bit-of-logstash-cooking/ geoip
# https://home.regit.org/tag/logstash/
#Logs being parsed:
#conn.log
#dns.log
#ntp.log

input {

#Production Logs#############################
  file {
    type => "BRO_connlog"
    path => "/nsm/bro/logs/current/conn.log"
  }
  file {
    type => "BRO_dnslog"
    path => "/nsm/bro/logs/current/dns.log"
  }

  file {
    type => "BRO_ntplog"
    path => "/nsm/bro/logs/current/ntp.log"
  }

  file {
    type => "SSHPOT_sshlog"
    path => "/var/log/sshpot_auth.log"
  }

###################################################
}

filter {
  if [message] =~ /^#/ {
    drop {  }
  } else {
  
# SSHPOT_sshlog ######################
  if [type] == "SSHPOT_sshlog" {
      grok { 
        match => [ "message", "(?<ts>(.*?))\t(?<id.orig_h>(.*?))\t(?<user>(.*?))\t(?<pass>(.*?))\t" ]
      }
  }

# BRO_ntplog ######################
  if [type] == "BRO_ntplog" {
      grok { 
        match => [ "message", "(?<ts>(.*?))\t(?<uid>(.*?))\t(?<id.orig_h>(.*?))\t(?<id.resp_h>(.*?))\t(?<refid>(.*?))\t(?<code>(.*?))\t(?<stratum>(.*?))\t(?<poll>(.*?))\t(?<preceission>(.*?))\t(?<reftime>(.*?))\t(?<excess>(.*?))" ]
      }
      if [code] =~ /^4/ {
        drop {  }
       }
  }

# BRO_dnslog ######################
  if [type] == "BRO_dnslog" {
    grok {
match => [ "message", "(?<ts>(.*?))\t(?<uid>(.*?))\t(?<id.orig_h>(.*?))\t(?<id.orig_p>(.*?))\t(?<id.resp_h>(.*?))\t(?<id.resp_p>(.*?))\t(?<proto>(.*?))\t(?<trans_id>(.*?))\t(?<query>(.*?))\t(?<qclass>(.*?))\t(?<qclass_name>(.*?))\t(?<qtype>(.*?))\t(?<qtype_name>(.*?))\t(?<rcode>(.*?))\t(?<rcode_name>(.*?))\t(?<AA>(.*?))\t(?<TC>(.*?))\t(?<RD>(.*?))\t(?<RA>(.*?))\t(?<Z>(.*?))\t(?<answers>(.*?))\t(?<TTLs>(.*?))\t(?<rejected>(.*))" ]
    }
  }
  
# BRO_connlog ######################
  if [type] == "BRO_connlog" {
    grok {
match => [ "message", "(?<ts>(.*?))\t(?<uid>(.*?))\t(?<id.orig_h>(.*?))\t(?<id.orig_p>(.*?))\t(?<id.resp_h>(.*?))\t(?<id.resp_p>(.*?))\t(?<proto>(.*?))\t(?<service>(.*?))\t(?<duration>(.*?))\t(?<orig_bytes>(.*?))\t(?<resp_bytes>(.*?))\t(?<conn_state>(.*?))\t(?<local_orig>(.*?))\t(?<missed_bytes>(.*?))\t(?<history>(.*?))\t(?<orig_pkts>(.*?))\t(?<orig_ip_bytes>(.*?))\t(?<resp_pkts>(.*?))\t(?<resp_ip_bytes>(.*?))\t(?<tunnel_parents>(.*?))" ]
    }
  }
 }
  if [id.orig_h]  {
    geoip {
      source => "id.orig_h"
      target => "geoip"
      add_field => [ "[geoip][coordinates]", "%{[geoip][longitude]}" ]
      add_field => [ "[geoip][coordinates]", "%{[geoip][latitude]}"  ]
    }
    mutate {
      convert => [ "[geoip][coordinates]", "float" ]
    } 
    mutate {
      uppercase => [ "geoip.country_code2" ]
    }
  }
}