Logstash snort

input {
	#stdin {
        #        type => "stdin-type"
        #}
        file {
                path => "/var/log/mymessages"
		start_position => "end"
		sincedb_path => "/opt/logstash/.sincedb*"
        }
}

filter {
        grok {
                match => [ "message", "%{SYSLOGTIMESTAMP:date} %{IPORHOST:device} %{WORD:snort}\[%{INT:snort_pid}\]\: \[%{INT:gid}\:%{INT:sid}\:%{INT:rev}\] %{DATA:ids_alert} \[Classification\: %{DATA:ids_classification}\] \[Priority\: %{INT:ids_priority}\] \{%{WORD:proto}\} %{IP:ids_src_ip}\:%{INT:ids_src_port} \-\> %{IP:ids_dst_ip}\:%{INT:ids_dst_port}" ]
                match => [ "message", "%{SYSLOGTIMESTAMP:date} gateway %{WORD:kernel}: \[%{BASE10NUM:unixtime}\] IN=ppp0 OUT= MAC= SRC=%{IP:src_ip} DST=%{IP:dst_ip} LEN=%{NUMBER:len} TOS=%{DATA:junk} PREC=%{DATA:junk} TTL=%{NUMBER:junk} ID=%{NUMBER:junk} DF PROTO=%{WORD:proto} SPT=%{NUMBER:src_port} DPT=%{NUMBER:dst_port} WINDOW=%{NUMBER:junk} RES=%{DATA:junk} %{DATA:flags} URGP=0" ]
                match => [ "message", "%{SYSLOGTIMESTAMP:date} gateway %{WORD:kernel}: \[%{BASE10NUM:unixtime}\] IN=ppp0 OUT= MAC= SRC=%{IP:src_ip} DST=%{IP:dst_ip} LEN=%{NUMBER:len} TOS=%{DATA:junk} PREC=%{DATA:junk} TTL=%{NUMBER:junk} ID=%{NUMBER:junk } PROTO=%{WORD:proto} SPT=%{NUMBER:src_port} DPT=%{NUMBER:dst_port} WINDOW=%{NUMBER:junk} RES=%{DATA:junk} %{DATA:flags} URGP=0" ]
                match => [ "message", "%{SYSLOGTIMESTAMP:date} gateway kernel: \[%{BASE10NUM:unixtime}\] IN=ppp0 OUT= MAC= SRC=%{IP:src_ip} DST=%{IP:dst_ip} LEN=%{POSINT:fullen} TOS=%{DATA:junk} PREC=%{DATA:junk} TTL=%{POSINT:junk} ID=%{NUMBER:junk} DF PROTO=%{WORD:proto} SPT=%{POSINT:src_port} DPT=%{POSINT:dst_port} LEN=%{POSINT:len}" ]
                match => [ "message", "%{SYSLOGTIMESTAMP:date} gateway kernel: \[%{BASE10NUM:unixtime}\] IN=ppp0 OUT= MAC= SRC=%{IP:src_ip} DST=%{IP:dst_ip} LEN=%{POSINT:fullen} TOS=%{DATA:junk} PREC=%{DATA:junk} TTL=%{POSINT:junk} ID=%{NUMBER:junk} PROTO=%{WORD:proto} SPT=%{POSINT:src_port} DPT=%{POSINT:dst_port} LEN=%{POSINT:len} MARK=%{DATA:junk}" ]
		match => [ "message", "%{SYSLOGTIMESTAMP:date} gateway %{SYSLOGPROG}: warning: %{HOSTNAME}\[%{IP:src_ip}\]: %{WORD:sasl} %{GREEDYDATA:data}" ]
                remove_field => [ "program", "pid", "data", "snort_pid", "ids_classification", "ids_priority", "junk", "unixtime" ]
        }

        if [message] !~ "snort\[[0-9]{1,6}\]: \[[0-9]{1,6}:[0-9]{1,10}:[0-9]{1,6}\]|IN=ppp0 OUT= MAC=|IN= OUT=ppp0 MAC=|SASL PLAIN authentication failed|SASL LOGIN authentication failed" {

		drop { }

        	} else if [message] =~ "snort\[[0-9]{1,6}\]: \[[0-9]{1,6}:[0-9]{1,10}:[0-9]{1,6}\]" {
                	#ids source IP
                	geoip {
                        	source => "ids_src_ip"
                        	target => "ids_src_geoip"
                        	fields => [ "ip", "country_code2", "country_name", "latitude", "longitude" ]
                	}
                	mutate {
                        	add_field => [ "ids_src_coordinates", "%{[ids_src_geoip][longitude]}", "ids_src_tmplat", "%{[ids_src_geoip][latitude]}" ]
                	}
                	mutate {
                        	merge => [ "ids_src_coordinates", "ids_src_tmplat" ]
                	}
                	mutate {
                        	convert => [ "ids_src_coordinates", "float" ]
                	}

                	#ids dest ip
                	geoip {
                        	source => "ids_dst_ip"
                        	target => "ids_dst_geoip"
                        	fields => [ "ip", "country_code2", "country_name", "latitude", "longitude" ]
                	}
                	mutate {
                        	add_field => [ "ids_dst_coordinates", "%{[ids_dst_geoip][longitude]}", "ids_dst_tmplat", "%{[ids_dst_geoip][latitude]}" ]
                	}
                	mutate {
                        	merge => [ "ids_dst_coordinates", "ids_dst_tmplat" ]
                	}
                	mutate {
                        	convert => [ "ids_dst_coordinates", "float" ]
                	}

		} else if [message] =~ "IN=ppp0 OUT= MAC=|IN= OUT=ppp0 MAC=" {
                	#iptables source ip
                	geoip {
                        	source => "src_ip"
                        	target => "src_geoip"
                        	fields => [ "ip", "country_code2", "country_name", "latitude", "longitude" ]
                	}
                	mutate {
                        	add_field => [ "src_coordinates", "%{[src_geoip][longitude]}", "src_tmplat", "%{[src_geoip][latitude]}" ]
                	}
                	mutate {
                        	merge => [ "src_coordinates", "src_tmplat" ]
                	}
                	mutate {
                        	convert => [ "src_coordinates", "float" ]
                	}

                	#iptables dest ip
                	geoip {
                        	source => "dst_ip"
                        	target => "dst_geoip"
                        	fields => [ "ip", "country_code2", "country_name", "latitude", "longitude" ]
                	}
                	mutate {
                        	add_field => [ "dst_coordinates", "%{[dst_geoip][longitude]}", "dst_tmplat", "%{[dst_geoip][latitude]}" ]
                	}
                	mutate {
                        	merge => [ "dst_coordinates", "dst_tmplat" ]
                	}
                	mutate {
                        	convert => [ "dst_coordinates", "float" ]
                	}

		} else if [message] =~ "SASL PLAIN authentication failed|SASL LOGIN authentication failed" {
			#sasl source ip
                        geoip {
                                source => "src_ip"
                                target => "src_geoip"
                                fields => [ "ip", "country_code2", "country_name", "latitude", "longitude" ]
                        }
                        mutate {
                                add_field => [ "src_coordinates", "%{[src_geoip][longitude]}", "src_tmplat", "%{[src_geoip][latitude]}" ]
                        }
                        mutate {
                                merge => [ "src_coordinates", "src_tmplat" ]
                        }
                        mutate {
                                convert => [ "src_coordinates", "float" ]
                        }
		}

                mutate {
                        gsub => [ "ids_alert", "[ \-\(\)]",  "_" ]
                        gsub => [ "src_geoip.country_name", "[ ]", "_" ]
                        gsub => [ "dst_geoip.country_name", "[ ]", "_" ]
                        remove_field => [ "ids_src_tmplat", "ids_dst_tmplat", "src_tmplat", "dst_tmplat" ]
                }
}


output {
	#stdout { codec => rubydebug }
        elasticsearch { embedded => true }
}