securityonion/salt/elasticsearch/files/ingest/syslog

{
  "description" : "syslog",
  "processors" : [
    {
        "dissect": {
                "field": "message",
                "pattern" : "%{message}",
                "on_failure": [ { "drop" : { } } ]
        },
        "remove": {
                "field": [ "type", "agent" ],
                "ignore_failure": true
        }
    },
    { "grok":           { "field": "message",       "patterns": ["<%{INT:syslog.priority}>%{DATA:syslog.timestamp} %{WORD:source.application}: %{GREEDYDATA:real_message}"], "ignore_failure": false } },
    { "set": { "if": "ctx.source?.application == 'filterlog'", "field": "dataset", "value": "firewall" } },
    { "pipeline": { "if": "ctx.dataset == 'firewall'", "name": "filterlog" } },
    { "pipeline":       { "name": "common"                                             } }
  ]
}