This gist has moved to its own repository HERE
See you there!
This gist has moved to its own repository HERE
See you there!
| #!/usr/bin/env python3 | |
| """Simple HTTP Server With Upload. | |
| This module builds on BaseHTTPServer by implementing the standard GET | |
| and HEAD requests in a fairly straightforward manner. | |
| see: https://gist.github.com/UniIsland/3346170 | |
| """ | |
| # Use this filter with pattern file https://gist.github.com/elijahpaul/f5f32d4e914dcb7fedd2 | |
| filter { | |
| if "PFSense" in [tags] { | |
| grok { | |
| add_tag => [ "firewall" ] | |
| match => [ "message", "<(?<evtid>.*)>(?<datetime>(?:Jan(?:uary)?|Feb(?:ruary)?|Mar(?:ch)?|Apr(?:il)?|May|Jun(?:e)?|Jul(?:y)?|Aug(?:ust)?|Sep(?:tember)?|Oct(?:ober)?|Nov(?:ember)?|Dec(?:ember)?)\s+(?:(?:0[1-9])|(?:[12][0-9])|(?:3[01])|[1-9]) (?:2[0123]|[01]?[0-9]):(?:[0-5][0-9]):(?:[0-5][0-9])) (?<prog>.*?): (?<msg>.*)" ] | |
| } | |
| mutate { | |
| gsub => ["datetime"," "," "] | |
| } |