filter {

        # Extract fields from the each of the detailed message types
        # The patterns provided below are included in core of LogStash 1.4.2.
        grok {
                match => [
                        "message", "%{CISCOFW106001}",
                        "message", "%{CISCOFW106006_106007_106010}",
                        "message", "%{CISCOFW106014}",
                        "message", "%{CISCOFW106015}",
                        "message", "%{CISCOFW106021}",
                        "message", "%{CISCOFW106023}",
                        "message", "%{CISCOFW106100}",
                        "message", "%{CISCOFW110002}",
                        "message", "%{CISCOFW302010}",
                        "message", "%{CISCOFW302013_302014_302015_302016}",
                        "message", "%{CISCOFW302020_302021}",
                        "message", "%{CISCOFW305011}",
                        "message", "%{CISCOFW313001_313004_313008}",
                        "message", "%{CISCOFW313005}",
                        "message", "%{CISCOFW402117}",
                        "message", "%{CISCOFW402119}",
                        "message", "%{CISCOFW419001}",
                        "message", "%{CISCOFW419002}",
                        "message", "%{CISCOFW500004}",
                        "message", "%{CISCOFW602303_602304}",
                        "message", "%{CISCOFW710001_710002_710003_710005_710006}",
                        "message", "%{CISCOFW713172}",
                        "message", "%{CISCOFW733100}"
                ]
        }

        # Parse the syslog severity and facility
        syslog_pri { }


alter {
 condrewrite =>[
         "action", "denied by ACL", "deny",
         "action", "Deny", "deny",
         "action", "Denied", "deny",
         "action",  "denied", "deny"
 ]

alter {
 condrewrite =>[
         "protocol", "TCP", "tcp",
         "protocol", "UDP", "udp",
         "protocol", "ICMP", "icmp",
         "protocol",  "DNS", "dns"
 ]
}


# Do a DNS lookup for the sending host
# Otherwise host field will contain an
# IP address instead of a hostname
#mutate {
#      add_field => { "dst_resolved" => "%{dst_ip}" }
#}

#dns {
#    reverse => [ "[dst_resolved]" ]
#    action => "replace"
#  }

geoip {
      #add_tag => [ "Whois" ]
      source => "src_ip"
      target => "src_geoip"
      database => "/etc/logstash/geoDB/GeoLiteCity.dat"
      add_field => [ "[src_geoip][coordinates]", "%{[src_geoip][longitude]}" ]
      add_field => [ "[src_geoip][coordinates]", "%{[src_geoip][latitude]}"  ]
    }
    mutate {
      convert => [ "[src_geoip][coordinates]", "float"]
    }
    mutate {
      add_field => { "whois" => "https://who.is/whois-ip/ip-address/%{dst_ip}"}
    }

    # do GeoIP lookup for the ASN/ISP information.
    geoip {
      database => "/etc/logstash/geoDB/GeoIPASNum.dat"
      source => "src_ip"
    }

geoip {
      #add_tag => [ "Whois" ]
      source => "dst_ip"
      target => "dst_geoip"
      database => "/etc/logstash/geoDB/GeoLiteCity.dat"
      add_field => [ "[dst_geoip][coordinates]", "%{[dst_geoip][longitude]}" ]
      add_field => [ "[dst_geoip][coordinates]", "%{[dst_geoip][latitude]}"  ]
    }
    mutate {
      convert => [ "[dst_geoip][coordinates]", "float"]
    }
    # do GeoIP lookup for the ASN/ISP information.
    geoip {
      database => "/etc/logstash/geoDB/GeoIPASNum.dat"
      source => "dst_ip"
    }

}