# Author: Justin Henderson
#         SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Updated by: Doug Burks
# Last Update: 5/20/2017

filter {
  if [source_ip] {
    if [source_ip] == "-" {
      mutate {
        replace => { "source_ip" => "0.0.0.0" }
      }
    }
    if [source_ip] =~ "10\." or [source_ip] =~ "192\.168\." or [source_ip] =~ "172\.(1[6-9]|2[0-9]|3[0-1])\." or [source_ip] =~ "fe80::20c:29ff:fe19:f7d" or [source_ip] =~ "::1" {
	mutate {
	}
      } else {
        geoip {
          source => "[source_ip]"
          target => "source_geo"
        }
      }
    if [source_ip] {
      mutate {
        add_field => { "ips" => "%{source_ip}" }
        add_field => { "source_ips" => [ "%{source_ip}" ] }
      }
    }
  }
  if [destination_ip] {
    if [destination_ip] == "-" {
      mutate {
        replace => { "destination_ip" => "0.0.0.0" }
      }
    }
    if [destination_ip] =~ "10\." or [destination_ip] =~ "192\.168\." or [destination_ip] =~ "172\.(1[6-9]|2[0-9]|3[0-1])\." or [destination_ip] =~ "239.255.255.250" or [destination_ip] =~ "224\.0\.0\." or [destination_ip] =~ "255.255.255.255" or [destination_ip] =~ "ff02::fb" or [destination_ip] =~ "fe80::20c:29ff:fe19:f7d" or [destination_ip] =~ "224\.0\.1\." {
      mutate {
      }
    }
    else {
      geoip {
      source => "[destination_ip]"
      target => "destination_geo"
      }
    }
  }
  if [destination_ip] {
    mutate {
      add_field => { "ips" => "%{destination_ip}" }
      add_field => { "destination_ips" => [ "%{destination_ip}" ] }
    }
  }
}
  #if [source_ip] or [destination_ip] {
  #  mutate {
	  #add_tag => [ "conf_file_8001"]
  #	}
  #}

