input {
    beats {
        port => 5044
        ssl => true
        ssl_certificate_authorities => ["/etc/elk/certs/ca/ca.crt"]
        ssl_certificate => "/etc/elk/instances/instances.crt"
        ssl_key => "/etc/elk/instances/logs.pkcs8.key"
        ssl_key_passphrase => "*secret*"
        ssl_verify_mode => "force_peer"
    }
}
filter {
    if [agent][type] == "auditbeat" {
        if [event][dataset] != "login" {
            drop {}
        } else {
            mutate {
                add_tag => ["important"]
            }
        }
    }
    if [log][file][path] = ~"mongo.*\.log$" {
        grok {
            match => {
                "message" => "\A%{TIMESTAMP_ISO8601} I ACCESS   %{NOTSPACE} SCRAM-SHA-1 authentication failed for %{USER:User} on %{USER:DB} from client %{SYSLOGHOST:From}:%{INT:Port} ; %{GREEDYDATA:Reason}"
            }

        }
        mutate {
            add_tag => ["mongosIfStatement"]
        }
        mutate {
            add_tag => ["important"]
        }
    }
    if [log][file][path] = ~"mysql.*\.log$" {
        grok {
            match => {
                "message" => "%{TIMESTAMP_ISO8601:Date} %{INT:Number} \[Note] Access denied for user '%{USER:User}'@'%{SYSLOGHOST:IP}' \(using password: %{WORD:Password}%{GREEDYDATA}"
            }
        }
        mutate {
            add_tag => ["important"]
        }
        mutate {
            add_tag => ["MySQLloginfail"]
        }
    }
    if [log][file][path] = ~/\.json$/ {
        json {
            source => "message"
        }
    }
    if [log][file][path] = ~"commands.log" {
        grok {
            match => {
                "message" => "\A%{SYSLOGTIMESTAMP:sys_timestamp} %{NOTSPACE:Hostname} %{USER:Logged}: USER=%{USER:User} PWD=%{UNIXPATH:Directory} PID=\[%{INT:PID}] CMD=\"%{DATA:Command}\" Exit=\[%{INT:Exit}\] CONNECTION=%{GREEDYDATA:Connection}"
            }
            match => {
                "message" => ["\[(%{TIMESTAMP_ISO8601:sys_timestamp})\]\s(?<Hostname>[0-9a-zA-Z_-]+)\s(?<Logged>[0-9a-zA-Z_-]+)\:USER=(?<User>[0-9a-zA-Z_-]+)\sPWD=(?<Directory>[0-9a-zA-Z_/-]+)\sPID=\[(?<PID>[0-9]+)\]\sCMD=\"(?<Command>.*)\"\sExit=\[(?<Exit>[0-9]+)\]\sCONNECTION=(?<Connetion>.*)", "\A%{SYSLOGTIMESTAMP:sys_timestamp} %{NOTSPACE:Hostname} %{USER:Logged}: USER=%{USER:User} PWD=%{UNIXPATH:Directory} PID=\[%{INT:PID}] CMD=%{QUOTEDSTRING:Command} Exit=\[%{INT:Exit}] CONNECTION=%{GREEDYDATA:Connection}"]
            }
            match => {
                "message" => "\A%{SYSLOGTIMESTAMP:sys_timestamp} %{HOSTNAME:Hostname} %{USER:Logged}: USER=%{USER:User} PWD=%{UNIXPATH:Directory} PID=\[%{INT:PID}] CMD=%{QUOTEDSTRING:Command} Exit=\[%{INT:Exit}] CONNECTION=%{GREEDYDATA:Connection}"
            }
        }
        mutate {
            add_tag => ["important"]
        }
    }
    if "important"
    not in [tags] {
        drop {}
    }
}
output {
    if [@metadata][pipeline] {
        elasticsearch {
            hosts => "https://localhost:9200"
            manage_template => false
            cacert => "/etc/elasticsearch/estackcap12extract.crt"
            ssl => true
            ssl_certificate_verification => false
            index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
            pipeline => "%{[@metadata][pipeline]}"
            user => "elastic"
            password => "*secret*"
        }
    } else {
        elasticsearch {
            # manage_template => false
            hosts => ["https://localhost:9200"]
            cacert => "/etc/elasticsearch/estackcap12extract.crt"
            ssl => true
            ssl_certificate_verification => false
            index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
            #index => "cleandata"
            user => "elastic"
            password => "*secret*"
        }
    }
}