# Author: Wes Lambert
#
# Adapted from existing filters provided by Justin Henderson
#
# Updated by: Doug Burks
#
# This conf file is based on accepting logs for pe.log from Bro systems
#
filter {
  if [type] == "bro_pe" {
        # If message looks like json, try to parse it as such. Otherwise, fall back to csv or grok.
        if [message] =~ /^{.*}$/ {
                json {
                        source => "message"
                }

                mutate {
                        rename => { "ts" => "timestamp" }
                        rename => { "id" => "fuid" }
			#machine
			#compile_ts
			#os
			#subsystem
			#is_exe
			#is_64bit
			#uses_aslr
			#uses_dep
			#uses_code_integrity
			#uses_seh
			#has_import_table
			#has_export_table
			#has_cert_table
			#has_debug_data
			#section_names
		}
	} else {
	    mutate {
	      gsub => [ "message", "[\"']", "" ]
	    }
	    csv {
	      columns => ["timestamp","fuid","machine","compile_ts","os","subsystem","is_exe","is_64bit","uses_aslr","uses_dep","uses_code_integrity","uses_seh","has_import_table","has_export_table","has_cert_table","has_debug_data","section_names"]
	    separator => "	"
	    }
	}
  }
}
