loganalyser.config.default

[
{
     "path": "/var/log/auth.log",
     "name": "auth_ssh",
     "output": "mongo",
     "retention": 120,
     "filter": [
     {
     "regex": "(%SYSLOG_TIMESTAMP:timestamp) (%NAME:host).*: Accepted (%STR:access) for (%NAME:username) from (%IP:addr) port (%NUM:port) (%WORD:protocol)",
     "emit":
	     {
	        "host": "{host}",
	        "hostname": "$hostname",
	        "timestamp": "{timestamp}",
             "username": "{username}",
             "access": "{access}",
             "ip_address": "{addr}",
             "port": "{port}",
             "protocol": "{protocol}",
             "type": "connect"
        },
        "transform": {
            "timestamp": "date",
            "port": "int"
	     },
	     "notify": [{
	        "name": "telegram",
	        "condition": [ {"ip_address": "local", "username": "all"} ]
	     }]
    },
    {
     "regex": "(%SYSLOG_TIMESTAMP:timestamp) (%NAME:host).*: Failed (%STR:access) for (?:invalid user )?(%NAME:username) from (%IP:addr) port (%NUM:port) (%NAME:protocol)",
	     "emit":
	     {
	        "host": "{host}",
	        "hostname": "$hostname",
	         "timestamp": "{timestamp}",
             "username": "{username}",
             "access": "{access}",
             "ip_address": "{addr}",
             "port": "{port}",
             "protocol": "{protocol}",
             "type": "failed"
        },
        "transform": {
            "timestamp": "date",
            "port": "int"
        },
	     "notify": [{
	     }]
     },
     {
     "regex": "(%SYSLOG_TIMESTAMP:timestamp) (%NAME:host).*: Disconnected from user (%NAME:username) (%IP:addr) port (%NUM:port)",
	     "emit":
	     {
	        "host": "{host}",
	        "hostname": "$hostname",
	        "timestamp": "{timestamp}",
            "username": "{username}",
	        "ip_address": "{addr}",
	        "port": "{port}",
	        "type": "disconnect"
        },
        "transform": {
            "timestamp": "date",
            "port": "int"
        },
        "notify": [{
	    }]
     }
     ]
},
{
     "path": "/var/log/apache2/access.log",
     "name": "apache_access",
     "output": "mongo",
     "retention": 120,
      "filter": [
        {
         "regex": "(%IP:addr) (%STR:unknown) (%NAME:username) (%APACHE_TIMESTAMP:date) \\\"(%ALPHA:cmd) (%STR:path) (%WORD:protocol)/(%VERSION:ver)\\\" (%NUM:code) (%NUM:size)",
         "emit":
             {
	        "hostname": "$hostname",
             "ip_address": "{addr}",
             "unknown": "{unknown}",
             "username": "{username}",
             "dummy": "{day}/{mon} {year} {time} {offset}",
             "timestamp": "{date}",
             "http_command": "{cmd}",
             "path": "{path}",
             "protocol": "{protocol}",
             "protocol_version": "{ver}",
             "code": "{code}",
             "size": "{size}"
        },
        "transform": {
            "timestamp": "date",
            "size": "int"
         },
        "notify" :[ {
	        "name": "telegram",
	        "condition": [ {"ip_address": ["nonlocal", "new"}, {"username": "~^test$"}]
	    }
	    }]
     ]
 },
{
     "path": "/var/log/syslog",
     "name": "nntp_proxy",
     "output": "mongo",
     "retention": 90,
     "filter": [
     {
         "regex": "(%SYSLOG_TIMESTAMP:timestamp) (%NAME:hostname) simpleproxy.*: Connect from (%IP4:address) [(](%HOST:from_address):(%NUM:port)->(%HOST:dest_address):(%NUM:dest_port)[)]$",
         "emit":
             {
	         "hostname": "$hostname",
             "ip_address": "{address}",
             "dest_address": "{dest_address}",
             "from_address": "{from_address}",
             "timestamp": "{timestamp}",
             "port": "{port}",
             "dest_port": "{dest_port}",
             "status": "open"
        },
        "transform": {
            "timestamp": "date",
            "size": "int",
            "post": "int",
            "dest_port": "int"
         },

        "notify" : [{
	        "name": "mongo",
	        "condition": [ {"ip_address": ["any" ]}]
	    }
	     ]

	    },
        {
         "regex": "(%SYSLOG_TIMESTAMP:timestamp) (%NAME:hostname) simpleproxy.*: Connect from (%IP4:address) [(](%HOST:from_address):(%NUM:port)->(%HOST:dest_address):(%NUM:dest_port)[)] closed. Up: (%NUM:up_bytes) bytes, Down: (%NUM:down_bytes) bytes",
         "emit":
             {
	         "hostname": "$hostname",
             "ip_address": "{address}",
             "dest_address": "{dest_address}",
             "from_address": "{from_address}",
             "timestamp": "{timestamp}",
             "port": "{port}",
             "dest_port": "{dest_port}",
             "status": "closed",
             "down_size": "{down_bytes}",
             "up_size": "{up_bytes}"
        },
        "transform": {
            "timestamp": "date",
            "size": "int",
            "post": "int",
            "dest_port": "int",
            "down_size": "int",
            "up_size": "int"
         },

        "notify" : [{
	        "name": "mongo",
	        "condition": [ {"ip_address": ["any" ]}]
	   }]

	    }
     ]
 }

]