infoblox.conf

# Config Name:  infoblox.conf
# Version:      v2.01.170909
# Created on:   04/07/17
# Author:       Willem D'Haese
# Purpose:      Infoblox Logstash Configuration File
# GitHub:       https://github.com/willemdh/logstash_filter_infoblox
# Copyright:
#   This program is free software: you can redistribute it and/or modify it
#   under the terms of the GNU General Public License as published by the Free
#   Software Foundation, either version 3 of the License, or (at your option)
#   any later version. This program is distributed in the hope that it will be
#   useful, but WITHOUT ANY WARRANTY; without even the implied warranty of
#   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General
#   Public License for more details. You should have received a copy of the
#   GNU General Public License along with this program.  If not, see
#   <http://www.gnu.org/licenses/>.

input {
  tcp {
    type => 'syslog-infoblox'
    port => xxxx
  }
}
filter {
  if [type] == "syslog-infoblox" {
    grok {
      match => [
        "message", "\A<%{POSINT:syslog_pri}>%{SYSLOGTIMESTAMP:syslog_timestamp} %{HOSTNAME:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}"
      ]
      add_tag => "grokked_syslog_infoblox"
    }
    date {
      match => [ 
        "syslog_timestamp", "MMM dd HH:mm:ss", "MMM  dd HH:mm:ss" 
      ]
    }
    mutate {
      copy => { "type" => "dig_type" }
      gsub => [ 
        "syslog_hostname", "<infoblox-ip>", "<infoblox-name>",
        "syslog_hostname", "<infoblox-ip>", "<infoblox-name>",
        "syslog_hostname", "<infoblox-ip>", "<infoblox-name>",
        "syslog_hostname", "<infoblox-ip>", "<infoblox-name>"
      ]
      copy => { "syslog_hostname" => "hostname" }
      remove_field => [ "syslog_timestamp" ]
    }
    translate {
      dictionary_path => [ "/etc/logstash/dictionaries/syslogpri.yml" ]
      field => "syslog_pri"
      destination => "syslog_severity"
    }
    if [syslog_program] == "dhcpd" {
      grok {          
        patterns_dir => "/etc/logstash/patterns"
        match => [ 
          "syslog_message", "%{DHCPREQUEST:dhcp_request} %{GREEDYDATA:dhcp_message}",
          "syslog_message", "%{DHCPMAP:dhcp_map}(: | )%{GREEDYDATA:dhcp_message}",
          "syslog_message", "%{DHCPOTHER:dhcp_system}(: | )%{GREEDYDATA:dhcp_message}",
          "syslog_message", "%{GREEDYDATA:dhcp_message}" 
          ]
        remove_tag => "grokked_syslog_infoblox"
        add_tag => "grokked_syslog_infoblox_dhcpd_basic"
      }
      if ([dhcp_map] =~ /.+/) {
        if ([dhcp_map] =~ /Added new forward map|Removed forward map|Unable to add forward map/) {
          grok {
            match => [ "dhcp_message", "from %{GREEDYDATA:dhcp_client_name} to %{IP:dhcp_client_ip}(: %{GREEDYDATA:dhcp_map_error})?" ]
            remove_tag => "grokked_syslog_infoblox_dhcpd_basic"
            add_tag => "grokked_syslog_infoblox_dhcpd_map_forward"
          }
        }
        if ([dhcp_map] =~ /Added reverse map|Removed reverse map|Unable to add reverse map/) {
          grok {
            match => [ "dhcp_message", "(from|on) %{GREEDYDATA:dhcp_client_reverse}( to %{GREEDYDATA:dhcp_client_name})?(: %{GREEDYDATA:dhcp_map_error})?" ]
            remove_tag => "grokked_syslog_infoblox_dhcpd_basic"
            add_tag => "grokked_syslog_infoblox_dhcpd_map_reverse"
          }
        }
        if ("grokked_syslog_infoblox_dhcpd_basic" in [tags]) {
           mutate {
             remove_tag => "grokked_syslog_infoblox_dhcpd_basic"
             add_tag => "grokked_syslog_infoblox_dhcpd_map_unknown"
           }
        }
        mutate {
          add_field => { "dhcp_system" => "Map" }
        }
      }
      else if ([dhcp_request] =~ /.+/) {
        if ([dhcp_request] == "DHCPDISCOVER") {
          grok {
            patterns_dir => "/etc/logstash/patterns"
            match => [ "dhcp_message", "from (%{IP:dhcp_client_ip}|%{INFOBLOXMAC:dhcp_client_mac}) (\(%{GREEDYDATA:dhcp_client_name}\) )?via %{INFOBLOXIP:dhcp_via_ip}( uid %{INFOBLOXMAC:dhcp_uid_mac})?" ]
            remove_tag => "grokked_syslog_infoblox_dhcpd_basic"
            add_tag => "grokked_syslog_infoblox_dhcpd_dhcpdiscover"
          }
        }
        if ([dhcp_request] == "DHCPOFFER") {
          grok {
            patterns_dir => "/etc/logstash/patterns"
            match => [
              "dhcp_message", "on %{IP:dhcp_client_ip} to %{INFOBLOXMAC:dhcp_client_mac}( \(%{GREEDYDATA:dhcp_client_name}\))? via %{INFOBLOXIP:dhcp_via_ip} relay %{INFOBLOXIP:dhcp_relay_ip} lease-duration %{NUMBER:dhcp_lease_duration}( offered-duration %{NUMBER:dhcp_offered_duration})?( uid %{INFOBLOXMAC:dhcp_uid_mac})?"
            ]
            remove_tag => "grokked_syslog_infoblox_dhcpd_basic"
            add_tag => "grokked_syslog_infoblox_dhcpd_dhcpoffer"
          }
        }
        if ([dhcp_request] == "DHCPREQUEST") {
          grok {
            patterns_dir => "/etc/logstash/patterns"
            match => [
              "dhcp_message", "for %{IP:dhcp_client_ip}( \(%{IP:dhcp_server_ip}\))? from %{INFOBLOXMAC:dhcp_client_mac}( \(%{GREEDYDATA:dhcp_client_name}\))? via %{INFOBLOXIP:dhcp_via_ip}( uid %{INFOBLOXMAC:dhcp_uid_mac})?( \(%{WORD:dhcp_action}\))?"
            ]
            remove_tag => "grokked_syslog_infoblox_dhcpd_basic"
            add_tag => "grokked_syslog_infoblox_dhcpd_dhcprequest"
          }
        }
        if ([dhcp_request] == "DHCPACK") {
          grok {
            patterns_dir => "/etc/logstash/patterns"
            match => [ 
              "dhcp_message", "to %{IP:dhcp_client_ip} \(%{INFOBLOXMAC:dhcp_client_mac}\) via %{INFOBLOXIP:dhcp_via_ip}",
              "dhcp_message", "on %{IP:dhcp_client_ip} to %{INFOBLOXMAC:dhcp_client_mac}( \(%{GREEDYDATA:dhcp_client_name}\))? via %{INFOBLOXIP:dhcp_via_ip} relay %{INFOBLOXIP:dhcp_relay_ip} lease-duration %{NUMBER:dhcp_lease_duration}( \(%{WORD:dhcp_action}\))?( uid %{INFOBLOXMAC:dhcp_uid_mac})?"
            ]
            remove_tag => "grokked_syslog_infoblox_dhcpd_basic"
            add_tag => "grokked_syslog_infoblox_dhcpd_dhcpack"
          }
        }
        if ([dhcp_request] == "DHCPNAK") {
          grok {
            patterns_dir => "/etc/logstash/patterns"
            match => [
              "dhcp_message", "on %{IP:dhcp_client_ip} to %{INFOBLOXMAC:dhcp_client_mac} via %{INFOBLOXIP:dhcp_via_ip}"
            ]
            remove_tag => "grokked_syslog_infoblox_dhcpd_basic"
            add_tag => "grokked_syslog_infoblox_dhcpd_dhcpnak"
          }
        }
        if ([dhcp_request] == "DHCPDECLINE") {
          grok {
            patterns_dir => "/etc/logstash/patterns"
            match => [
              "dhcp_message", "of %{IP:dhcp_client_ip} from %{INFOBLOXMAC:dhcp_client_mac} via %{INFOBLOXIP:dhcp_via_ip} : %{GREEDYDATA:dhcp_decline_reason}"
            ]
            remove_tag => "grokked_syslog_infoblox_dhcpd_basic"
            add_tag => "grokked_syslog_infoblox_dhcpd_dhcpdecline"
          }
        }
        if ([dhcp_request] == "DHCPRELEASE") {
          grok {
            patterns_dir => "/etc/logstash/patterns"
            match => [
              "dhcp_message", "of %{IP:dhcp_client_ip} from %{INFOBLOXMAC:dhcp_client_mac}( \(%{GREEDYDATA:dhcp_client_name}\))? via %{INFOBLOXIP:dhcp_via_ip}( \(%{WORD:dhcp_action}\))?( uid %{INFOBLOXMAC:dhcp_uid_mac})?"
            ]
            remove_tag => "grokked_syslog_infoblox_dhcpd_basic"
            add_tag => "grokked_syslog_infoblox_dhcpd_dhcprelease"
          }
        }
        if ([dhcp_request] == "DHCPINFORM") {
          grok {
            patterns_dir => "/etc/logstash/patterns"
            match => [
              "dhcp_message", "from %{IP:dhcp_client_ip} via %{INFOBLOXIP:dhcp_via_ip}( : %{GREEDYDATA:dhcp_inform_error})?"
            ]
            remove_tag => "grokked_syslog_infoblox_dhcpd_basic"
            add_tag => "grokked_syslog_infoblox_dhcpd_dhcpinform"
          }
        }
        if ([dhcp_request] == "RELEASE") {
          grok {
            patterns_dir => "/etc/logstash/patterns"
            match => [
              "dhcp_message", "on %{IP:dhcp_client_ip} to %{INFOBLOXMAC:dhcp_client_mac}"
            ]
            remove_tag => "grokked_syslog_infoblox_dhcpd_basic"
            add_tag => "grokked_syslog_infoblox_dhcpd_release"
          }
        }
        if ([dhcp_request] == "DHCPEXPIRE") {
          grok {
            patterns_dir => "/etc/logstash/patterns"
            match => [
              "dhcp_message", "on %{IP:dhcp_client_ip} to %{INFOBLOXMAC:dhcp_client_mac}"
            ]
            remove_tag => "grokked_syslog_infoblox_dhcpd_basic"
            add_tag => "grokked_syslog_infoblox_dhcpd_dhcpexpire"
          }
        }
        if ("grokked_syslog_infoblox_dhcpd_basic" in [tags]) {
           mutate {
             remove_tag => "grokked_syslog_infoblox_dhcpd_basic"
             add_tag => "grokked_syslog_infoblox_dhcpd_request_unknown"
           }
        }
        mutate {
          add_field => { "dhcp_system" => "Operation" }
        }
      }
      else if ([dhcp_system] =~ /.+/) {
        grok {
          match => [ "dhcp_message", "%{GREEDYDATA:dhcp_system_message}" ]
          remove_tag => "grokked_syslog_infoblox_dhcpd_basic"
          add_tag => "grokked_syslog_infoblox_dhcpd_system"
        } 
      }
      else {
        grok {
          match => [ "dhcp_message", "%{GREEDYDATA:dhcp_system_message}" ]
          remove_tag => "grokked_syslog_infoblox_dhcpd_basic"
          add_tag => "grokked_syslog_infoblox_dhcpd_other"
        }  
        mutate {
          add_field => { "dhcp_system" => "Other" }
        }
      }
      mutate {
        gsub => [
          "dhcp_via_ip", "eth2", "127.0.0.2",
          "dhcp_via_ip", "eth3", "127.0.0.3",
          "dhcp_relay_ip", "eth2", "127.0.0.2",
          "dhcp_relay_ip", "eth3", "127.0.0.3"
        ]
        remove_field => [ "message", "dhcp_message" ]
      }
    }
    if [syslog_program] == "named" {
      grok {
        patterns_dir => "/etc/logstash/patterns"
        match => [
          "syslog_message", "\Azone %{HOSTNAME:dns_zone}/IN: %{GREEDYDATA:dns_zone_message}\Z",
          "syslog_message", "\Aclient %{IP:dns_client_ip}#%{NUMBER:dns_client_key}(/key %{WORD:dns_client_signer})?: %{GREEDYDATA:dns_client_message}\Z"
        ]
        remove_tag => "grokked_syslog_infoblox"
        add_tag => "grokked_syslog_infoblox_named_basic"
      }
      if ([dns_zone] =~ /.+/) {
        grok {
          match => [
            "dns_zone_message", "\AZRQ applied %{WORD:dns_zone_action} for (''|\'%{NOTSPACE:dns_zone_host_name}\'): %{NUMBER:dns_zone_nr} IN %{WORD:dns_zone_record} %{GREEDYDATA:dns_zone_message}\Z",
            "dns_zone_message", "\AZRQ applied transaction %{NUMBER:dns_zone_transaction_id} with SOA serial %{NUMBER:dns_zone_soa_serial}\. Zone version is now %{NUMBER:dns_zone_version}\.\Z",
            "dns_zone_message", "\AZRQ applying transaction %{NUMBER:dns_zone_transaction_id}\.\Z",
            "dns_zone_message", "\Asending notifies \(serial %{NUMBER:dns_zone_serial}\)\Z"
          ]
          overwrite => [ "dns_zone_message" ]
          remove_tag => "grokked_syslog_infoblox_named_basic"
          add_tag => "grokked_syslog_infoblox_named_zone"
        }
        if ([dns_zone] =~ /in-addr.arpa/) {
          mutate {
            rename => { "dns_zone" => "dns_zone_reverse" }
          }
        }
        if ([dns_zone_record] =~ /.+/) {
          if ([dns_zone_record] == "SOA") {
            grok {
              match => [
               "dns_zone_message", "\A%{USER:dns_zone_server}. %{USER:dns_zone_user}\. %{GREEDYDATA:dns_zone_metrics}\.\Z"
              ]
              remove_tag => "grokked_syslog_infoblox_named_zone"
              add_tag => "grokked_syslog_infoblox_named_zone_soa"
            }
          }
          else if ([dns_zone_record] == "A") {
            grok {
              match => [
               "dns_zone_message", "\A%{IP:dns_zone_host_ip} \(none\)\.\Z"
              ]
              remove_tag => "grokked_syslog_infoblox_named_zone"
              add_tag => "grokked_syslog_infoblox_named_zone_a"
            }
          }
          else if ([dns_zone_record] == "PTR") {
            mutate {
              rename => { "dns_zone_host_name" => "dns_zone_host_reverse" }
            }
            grok {
              match => [
               "dns_zone_message", "\A%{USER:dns_zone_host_name}\. \(none\)\.\Z"
              ]
              remove_tag => "grokked_syslog_infoblox_named_zone"
              add_tag => "grokked_syslog_infoblox_named_zone_ptr"
            }
          }
          else {
            grok {
              match => [
               "dns_zone_message", "\A%{GREEDYDATA:dns_zone_rest}\Z"
              ]
              remove_tag => "grokked_syslog_infoblox_named_zone"
              add_tag => "grokked_syslog_infoblox_named_zone_rest"
            }
          }
          mutate {
            add_field => { "dns_system" => "Zone Update" }
          }
        }
        else if ([dns_zone_serial] =~ /.+/) {
          mutate {
            remove_tag => "grokked_syslog_infoblox_named_zone"
            add_tag => "grokked_syslog_infoblox_named_zone_notifies"
            add_field => { "dns_system" => "Zone Notify" }
          }
        }
        else if ([dns_zone_transaction_id] =~ /.+/) {
          mutate {
            remove_tag => "grokked_syslog_infoblox_named_zone"
            add_tag => "grokked_syslog_infoblox_named_zone_transaction"
            add_field => { "dns_system" => "Zone Transaction" }
          }
        }
      }
      else if ([dns_client_ip] =~ /.+/) {
        grok {
          patterns_dir => "/etc/logstash/patterns"
          match => [
            "dns_client_message", "\Aupdating zone '%{HOSTNAME:dns_client_zone}/IN': (?<dns_client_system>adding an RR) at '%{HOSTNAME:dns_client_name}' %{WORD:dns_client_record_type} %{IP:dns_client_record_ip}\Z",
            "dns_client_message", "\Aupdating zone '%{HOSTNAME:dns_client_zone_reverse}/IN': (?<dns_client_system>adding an RR) at '%{HOSTNAME:dns_client_reverse}' %{WORD:dns_client_record_type} %{HOSTNAME:dns_client_name}\.\Z",
            "dns_client_message", "\Aupdating zone '%{HOSTNAME:dns_client_zone}/IN': (?<dns_client_system>deleting rrset) at '%{HOSTNAME:dns_client_name}' %{WORD:dns_client_record_type}\Z",
            "dns_client_message", "\Aupdating zone '%{HOSTNAME:dns_client_zone}/IN': (?<dns_client_system>deleting an RR) at %{HOSTNAME:dns_client_name} %{WORD:dns_client_record_type}\Z",
            "dns_client_message", "\A(?<dns_client_system>signer) \"%{NOTSPACE:dns_client_signer}\" %{WORD:dns_client_signer_result}\Z",
            "dns_client_message", "\A(?<dns_client_system>received notify for zone) '%{HOSTNAME:dns_client_notify_zone}'"
          ]
          remove_tag => "grokked_syslog_infoblox_named_basic"
          add_tag => "grokked_syslog_infoblox_named_client"
          overwrite => [ "dns_client_signer" ] 
        }
       if ([dns_client_notify_zone] =~ /in-addr.arpa/) {
          mutate {
            rename => { "dns_client_notify_zone" => "dns_client_notify_reverse" }
          }
        }

        mutate {
          add_field => { "dns_system" => "Client Action" }
          remove_field => [ "dns_client_message" ]    
        }
      }
      else {
        mutate {
          remove_tag => "grokked_syslog_infoblox_named_basic"
          add_tag => "grokked_syslog_infoblox_named_rest"
          add_field => { "dns_system" => "Other" }
        }
      }
    }
    if [syslog_program] == "httpd" {
      grok {
        patterns_dir => "/etc/logstash/patterns"
        match => [
          "syslog_message", "\A%{TIMESTAMP_ISO8601:infoblox_httpd_time} \[%{USERNAME:infoblox_user_name}]: %{WORD:infoblox_action} - - (to=%{WORD:infoblox_auth_system} )?ip=%{IP:infoblox_user_ip} (auth=%{WORD:infoblox_auth_type} )?group=%{WORD:infoblox_user_adgroup}( apparently_via=%{WORD:infoblox_via})?( trigger_event=%{NOTSPACE:infoblox_trigger})?\Z"
        ]
        remove_tag => "grokked_syslog_infoblox"
        add_tag => "grokked_syslog_infoblox_httpd"
      }
    }
  }
}
output {
  if [type] == "syslog-infoblox" {
    elasticsearch {
      index => "infoblox-001-%{+YYYY.MM.dd}"
      hosts => ["https://elastic-ingest-01:9200","https://elastic-ingest-02:9200"]
      ssl => true
      cacert => "path\to\ca.pem"
      manage_template => false
      user => "logstash_internal"
      password => "<password>"
      document_type => doc
    }
  }
}