# Author: Justin Henderson
#         SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Updated by: Doug Burks
# Last Update: 2/7/2018
#
# This conf file is based on accepting logs for dns.log from Bro systems
filter {
  if [type] == "bro_dns" {
        # If message looks like json, try to parse it as such. Otherwise, fall back to csv or grok.
        if [message] =~ /^{.*}$/ {
            json {
                  source => "message"
            }

	    mutate {
        	  rename => { "ts" => "timestamp" }
		  #uid
	          rename => { "id.orig_h" => "source_ip" }
        	  rename => { "id.orig_p" => "source_port" }
	          rename => { "id.resp_h" => "destination_ip" }
        	  rename => { "id.resp_p" => "destination_port" }
	          rename => { "proto" => "protocol" }
		  rename => { "trans_id" => "transaction_id" }
		  #rtt field
		  #query field
        	  rename => { "qclass" => "query_class" }
	          rename => { "qclass_name" => "query_class_name" }
        	  rename => { "qtype" => "query_type" }
	          rename => { "qtype_name" => "query_type_name" }
		  #rcode
		  #rcode_name
        	  rename => { "AA" => "aa" }
	          rename => { "TC" => "tc" }
        	  rename => { "RD" => "rd" }
	          rename => { "RA" => "ra" }
        	  rename => { "Z" => "z" }
		  #answers
        	  rename => { "TTLs" => "ttls" }
		  #rejected
            }
        } else {

	    mutate {
	      gsub => [ "message", "[\"']", "" ]
	    }
	    csv {
	      columns => ["timestamp","uid","source_ip","source_port","destination_ip","destination_port","protocol","transaction_id","rtt","query","query_class","query_class_name","query_type","query_type_name","rcode","rcode_name","aa","tc","rd","ra","z","answers","ttls","rejected"]

	      #If you use a custom delimiter, change the following value in between the quotes to your delimiter. Otherwise, insert a literal <tab> in between the two quotes on your logstash system, use a text editor like nano that doesn't convert tabs to spaces.
	      separator => "	"
	    }
	}

	mutate {
		add_tag => [ "dns" ]
	}
    if [ttls] == "-" {
      mutate {
        remove_field => [ "ttls" ]
      }
    }
    if [rtt] == "-" {
      mutate {
        remove_field => [ "rtt" ]
      }
    }
    #mutate {
      #convert => [ "rtt", "float" ]  
    #}
	mutate {
		#add_tag => [ "conf_file_1102"]
	}
  }
}
