A basic parser for VPC Flow Log, strongly inspired by node-clf-parser https://github.com/jfhbrook/node-clf-parser
- VPC FLow Log(CloudWatchLogs)->Lambda->ElasticSearch. Example awslabs/amazon-elasticsearch-lambda-samples
- Analyze VPC Flow Log
$npm install elb-log-parser
$node
> var parse = require('./index');
undefined
> parse('2 11111 eni-901258d8 133.130.120.204 172.31.23.15 123 123 17 3 228 1460005175 1460005449 ACCEPT OK')
{ version: '2',
account_id: '11111',
interface_id: 'eni-901258d8',
srcaddr: '133.130.120.204',
dstaddr: '172.31.23.15',
srcport: '123',
dstport: '123',
protocol: '17',
packets: '3',
byte: '228',
start: '1460005175',
end: '1460005449',
action: 'ACCEPT',
log_status: 'OK',
protocol_name: 'UDP',
start_utc: '2016-04-07 04:59:35',
end_utc: '2016-04-07 05:04:09' }
>
You get the idea.
$npm test
WTFPL