input {
  file {
    type => "syslog"
    path => "/var/log/secure"
  }
}

filter {
  if [type] == "syslog" {
      multiline {
        pattern => "^\t"
        what => "previous"
      }
  }

  if [message] =~ /sudo:.*COMMAND=/ {
      mutate { add_tag =>  [ "grepped" ] }
  }

  if [message] =~ /sshd:.*session opened for user/ {
      mutate { add_tag =>  [ "grepped" ] }
  }

  if [type] == "syslog" {
    if "grepped" in [tags] {

      grok {
        add_tag => [ "ssh" ]
        tag_on_failure => false
        # Example : Feb 25 23:14:09 el6a sshd[8766]: pam_unix(sshd:session): session opened for user lofic by (uid=0)
        match => [ "message",
         "%{MONTH}%{SPACE}%{MONTHDAY}%{SPACE}%{TIME}%{SPACE}%{WORD:srchost}%{SPACE}sshd.*session opened for user %{WORD:user} by .*" ]
      }

       grok {
        add_tag => [ "sudo" ]
        tag_on_failure => false
        # Example : Feb 25 22:56:25 el6a sudo:    lofic : TTY=pts/1 ; PWD=/home/lofic ; USER=root ; COMMAND=/bin/su
        match => [ "message",
         "%{MONTH}%{SPACE}%{MONTHDAY}%{SPACE}%{TIME}%{SPACE}%{WORD:srchost}%{SPACE}sudo:%{SPACE}%{WORD:user}%{SPACE}.*;%{SPACE}COMMAND=%{GREEDYDATA:sudocmd}" ]
  }

    }

    grok {
      tag_on_failure => false
      add_tag => [ "noise" ]
      match => [ "message", ".*sshd.*Connection closed by 127.0.0.1" ]
    }

    grok {
      tag_on_failure => false
      add_tag => [ "noise" ]
      match   => [ "message", ".*su: .*session .* for user rabbitmq" ]
    }
  }

}

output {
  if "_grokparsefailure" not in [tags] and "noise" not in [tags] {
    elasticsearch_river {
      rabbitmq_host => "192.168.0.16"
      es_host => "el6e.labolinux.fr"
      vhost   => "/elasticsearch"
      user => "river"
      password =>"plokiploki"
    }
  }
}