Skip to content

Commit 9f57ea8

Browse files
belimawrbelimawr
committed
move grok step to a separated pipeline
1 parent f8e1093 commit 9f57ea8

4 files changed

Lines changed: 25 additions & 22 deletions

File tree

‎filebeat/module/system/auth/ingest/files.yml‎

Lines changed: 2 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -18,18 +18,9 @@ processors:
1818
TIMESTAMP: (?:%{TIMESTAMP_ISO8601}|%{SYSLOGTIMESTAMP})
1919
patterns:
2020
- '^%{TIMESTAMP:system.auth.timestamp} %{SYSLOGHOST:host.hostname}? %{DATA:process.name}(?:\[%{POSINT:process.pid:long}\])?:%{SPACE}%{GREEDYMULTILINE:_temp.message}$'
21-
- grok:
21+
- pipeline:
2222
description: Grok specific auth messages.
23-
tag: grok-specific-messages
24-
field: _temp.message
25-
ignore_missing: true
26-
patterns:
27-
- '^%{DATA:system.auth.ssh.event} %{DATA:system.auth.ssh.method} for (invalid user)?%{DATA:user.name} from %{IPORHOST:source.address} port %{NUMBER:source.port:long} ssh2(: %{GREEDYDATA:system.auth.ssh.signature})?'
28-
- '^%{DATA:system.auth.ssh.event} user %{DATA:user.name} from %{IPORHOST:source.address}'
29-
- '^Did not receive identification string from %{IPORHOST:system.auth.ssh.dropped_ip}'
30-
- '^%{DATA:user.name} :( %{DATA:system.auth.sudo.error} ;)? TTY=%{DATA:system.auth.sudo.tty} ; PWD=%{DATA:system.auth.sudo.pwd} ; USER=%{DATA:system.auth.sudo.user} ; COMMAND=%{GREEDYDATA:system.auth.sudo.command}'
31-
- '^new group: name=%{DATA:group.name}, GID=%{NUMBER:group.id}'
32-
- '^new user: name=%{DATA:user.name}, UID=%{NUMBER:user.id}, GID=%{NUMBER:group.id}, home=%{DATA:system.auth.useradd.home}, shell=%{DATA:system.auth.useradd.shell}$'
23+
name: '{< IngestPipeline "grok-auth-messages" >}'
3324
on_failure:
3425
- rename:
3526
description: Leave the unmatched content in message.

‎filebeat/module/system/auth/ingest/grok-auth-messages.yml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
description: Journald Pipeline for system/auth Filebeat module
2+
processors:
3+
- grok:
4+
description: Grok specific auth messages.
5+
tag: grok-specific-messages
6+
field: _temp.message
7+
ignore_missing: true
8+
patterns:
9+
- '^%{DATA:system.auth.ssh.event} %{DATA:system.auth.ssh.method} for (invalid user)?%{DATA:user.name} from %{IPORHOST:source.address} port %{NUMBER:source.port:long} ssh2(: %{GREEDYDATA:system.auth.ssh.signature})?'
10+
- '^%{DATA:system.auth.ssh.event} user %{DATA:user.name} from %{IPORHOST:source.address}'
11+
- '^Did not receive identification string from %{IPORHOST:system.auth.ssh.dropped_ip}'
12+
- '^%{DATA:user.name} :( %{DATA:system.auth.sudo.error} ;)? TTY=%{DATA:system.auth.sudo.tty} ; PWD=%{DATA:system.auth.sudo.pwd} ; USER=%{DATA:system.auth.sudo.user} ; COMMAND=%{GREEDYDATA:system.auth.sudo.command}'
13+
- '^new group: name=%{DATA:group.name}, GID=%{NUMBER:group.id}'
14+
- '^new user: name=%{DATA:user.name}, UID=%{NUMBER:user.id}, GID=%{NUMBER:group.id}, home=%{DATA:system.auth.useradd.home}, shell=%{DATA:system.auth.useradd.shell}$'

‎filebeat/module/system/auth/ingest/journald.yml‎

Lines changed: 8 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -6,19 +6,16 @@ processors:
66
- rename:
77
field: "journald.process.name"
88
target_field: process.name
9-
- grok:
10-
description: Grok specific auth messages.
11-
tag: grok-specific-messages
9+
- rename:
1210
field: message
13-
ignore_missing: true
14-
patterns:
15-
- '^%{DATA:system.auth.ssh.event} %{DATA:system.auth.ssh.method} for (invalid user)?%{DATA:user.name} from %{IPORHOST:source.address} port %{NUMBER:source.port:long} ssh2(: %{GREEDYDATA:system.auth.ssh.signature})?'
16-
- '^%{DATA:system.auth.ssh.event} user %{DATA:user.name} from %{IPORHOST:source.address}'
17-
- '^Did not receive identification string from %{IPORHOST:system.auth.ssh.dropped_ip}'
18-
- '^%{DATA:user.name} :( %{DATA:system.auth.sudo.error} ;)? TTY=%{DATA:system.auth.sudo.tty} ; PWD=%{DATA:system.auth.sudo.pwd} ; USER=%{DATA:system.auth.sudo.user} ; COMMAND=%{GREEDYDATA:system.auth.sudo.command}'
19-
- '^new group: name=%{DATA:group.name}, GID=%{NUMBER:group.id}'
20-
- '^new user: name=%{DATA:user.name}, UID=%{NUMBER:user.id}, GID=%{NUMBER:group.id}, home=%{DATA:system.auth.useradd.home}, shell=%{DATA:system.auth.useradd.shell}$'
11+
target_field: _temp.message
12+
- pipeline:
13+
description: Grok specific auth messages.
14+
name: '{< IngestPipeline "grok-auth-messages" >}'
2115
ignore_failure: true
16+
- rename:
17+
field: _temp.message
18+
target_field: message
2219
- grok:
2320
description: Grok usernames from PAM messages.
2421
tag: grok-pam-users

‎filebeat/module/system/auth/manifest.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,4 +21,5 @@ ingest_pipeline:
2121
- ingest/entrypoint.yml
2222
- ingest/files.yml
2323
- ingest/journald.yml
24+
- ingest/grok-auth-messages.yml
2425
input: config/auth.yml

0 commit comments

Comments
 (0)