# Original Author: Justin Henderson
#         SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Updated by: Doug Burks
# Last Update: 2/7/2018
#
# This conf file is based on accepting logs for socks.log from Bro systems

# Parse using csv
filter {
  if [type] == "bro_socks" {
        # If message looks like json, try to parse it as such. Otherwise, fall back to csv or grok.
        if [message] =~ /^{.*}$/ {
                json {
                        source => "message"
                }

                mutate {
                        rename => { "ts" => "timestamp" }
                        #uid
                        rename => { "id.orig_h" => "source_ip" }
                        rename => { "id.orig_p" => "source_port" }
                        rename => { "id.resp_h" => "destination_ip" }
                        rename => { "id.resp_p" => "destination_port" }
			#version
			#convert => { "version" => "string" }
			rename => { "user" => "username" }
			#password
			rename => { "status" => "server_status" }
			rename => { "request.host" => "request_host" }
			rename => { "request.name" => "request_name" }
			rename => { "request_p" => "request_port" }
			rename => { "bound.host" => "bound_host" }
			rename => { "bound.name" => "bound_name" }
			rename => { "bound_p" => "bound_port" }
		}
	} else {
	    mutate {
	      gsub => [ "message", "[\"']", "" ]
	    }
	    csv {
	      columns => ["timestamp","uid","source_ip","source_port","destination_ip","destination_port","version","username","password","server_status","request_host","request_name","request_port","bound_host","bound_name","bound_port"]
	      separator => "	"
	    }
	}

        mutate {
                #add_tag => [ "conf_file_1122"]
        }
  }
}
# Parse using grok
#filter {
#  if [type] == "bro_socks" {
#    # This is the initial parsing of the log
#    grok {
#      match => [ "message", "(?<timestamp>(.*?))\t(?<uid>(.*?))\t(?<source_ip>(.*?))\t(?<source_port>(.*?))\t(?<destination_ip>(.*?))\t(?<destination_port>(.*?))\t(?<version>(.*?))\t(?<user>(.*?))\t(?<password>(.*?))\t(?<status>(.*))\t(?<request_host>(.*))\t(?<request_name>(.*))\t(?<request_port>(.*))\t(?<bound_host>(.*))\t(?<bound_name>(.*))\t(?<bound_port>(.*))" ]
#    }
#	mutate {
#		#add_tag => [ "conf_file_1122"]
#	}
#  }
#}
