# Author: Wes Lambert
#
# Adapted from existing filters provided by Justin Henderson
#
# Updated by: Doug Burks
# Last Update: 2/7/2018
#
# This conf file is based on accepting logs for dce_rpc.log from Bro systems
#
filter {
  if [type] == "bro_dce_rpc" {
        # If message looks like json, try to parse it as such. Otherwise, fall back to csv or grok.
        if [message] =~ /^{.*}$/ {
                json {
                        source => "message"
                }

                mutate {
                        rename => { "ts" => "timestamp" }
                        #uid
                        rename => { "id.orig_h" => "source_ip" }
                        rename => { "id.orig_p" => "source_port" }
                        rename => { "id.resp_h" => "destination_ip" }
                        rename => { "id.resp_p" => "destination_port" }
			#rtt
			#named_pipe
			#endpoint
			#operation
		}

		#mutate {
			#convert => { "rtt" => "float" }
		#}
	} else {
	    mutate {
	      gsub => [ "message", "[\"']", "" ]
	    }
	    csv {
	      columns => ["timestamp","uid","source_ip","source_port","destination_ip","destination_port","rtt","named_pipe","endpoint","operation"]
	    separator => "	"
	    }

	    if [rtt] == "-" {
              mutate {
                remove_field => [ "rtt" ]
              }
            }

	    #mutate {
	      #convert => [ "rtt", "float" ]
            #}
	}
  }
}
