Question

我想在logstash中过滤“新进程名称：C：\ Windows \ System32 \ notepad.exe”。

此处是由ossec代理

创建的Windows事件日志

** Alert 1460299512.116024: - windows,authentication_success,
2016 Apr 10 16:45:12 (windows10) 192.168.0.17->WinEvtLog
Rule: 18107 (level 3) -> 'Process Creation.'
User: (no user)
2016 Apr 10 07:45:09 WinEvtLog: Security: AUDIT_SUCCESS(4688): Microsoft-Windows-Security-Auditing: (no user): no domain: DESKTOP-2D562R2: A new process has been created. Subject:  Security ID:  S-1-5-21-3956991881-1104172218-599705502-1001  Account Name:  Localroot  Account Domain:  DESKTOP-2D562R2  Logon ID:  0x27c1e  Process Information:  New Process ID:  0x12a8  New Process Name: C:\Windows\System32\notepad.exe  Token Elevation Type: %%1938  Creator Process ID: 0x1a0`enter code here`

我在logstash中使用此过滤器

root@ubuntulogstash:/etc/logstash/conf.d# cat all.conf
input {
# stdin{}
  udp {
     port => 9000
     type => "syslog"
  }
}
filter {
  if [type] == "syslog" {
    grok {
      match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_host} %{DATA:syslog_program}: Alert Level: %{BASE10NUM:Alert_Level}; Rule: %{BASE10NUM:Rule} - %{GREEDYDATA:Description}; Location: %{GREEDYDATA:Details}" }
      add_field => [ "ossec_server", "%{host}" ]
}
   }
    mutate {
      remove_field => [ "syslog_hostname", "syslog_message", "syslog_pid", "message", "@version", "type", "host" ]
    }
  }
}
output {
  elasticsearch {
        hosts => ["192.168.0.30:9200"]
        index => "ossec"
#       protocol => http
                }
stdout { codec => rubydebug }
}

Answer 1

像

这样的东西

New Process Name: %{NOTSPACE:processName}%SPACE

将以grok模式工作

Windows事件日志Logstash和Elasticsearch过滤器不起作用

1 个答案: