#########################################################################
##### ВЕРСИЯ НЕ РАБОЧАЯ!!!! ТОЛЬКО ДЛЯ СЕБЯ ЧТОБ ДОПИЛИТЬ ДО УМА!!!! ####
#########################################################################

################# INPUT #################

input {	
	file {
		path => [ "/tmp/openvpn/openvpn.*" ]
		sincedb_path => "/dev/null"
		start_position => "beginning"
	}
}

################# FILTER #################

filter {
	if "IV_PLAT=" in [message] {	# Операционная система клиента
		grok {
			match => {
				"message" => "%{MONTH:month} %{MONTHDAY:day} %{TIME:time} %{WORD:logsource} %{SYSLOGPROG} ?\[%{WORD:pid}?]: %{IP:ovpn.source.ip}:%{WORD} %{WORD} %{WORD}: %{WORD}=%{GREEDYDATA:ovpn.client.plat}"
			}
			add_tag => ["Client OS"]
		}
		if "_grokparsefailure" in [tags] {
			drop { }
		}
	}
	else if "IV_GUI_VER=" in [message] {	# Используемая программа-клиент
		grok {
			match => {
				"message" => "%{MONTH:month} %{MONTHDAY:day} %{TIME:time} %{WORD:logsource} %{SYSLOGPROG} ?\[%{WORD:pid}?]: %{IP:ovpn.source.ip}:%{WORD} %{WORD} %{WORD}: %{WORD}=%{GREEDYDATA:ovpn.client.guiversion}"
			}
			add_tag => ["Clien GUI"]
		}
		if "_grokparsefailure" in [tags] {
			drop { }
		}
	}
	else if "primary virtual IP" in [message] {	# Событие подключения, выдача внутреннего ip клиенту
		grok {
			match => {
				"message" => "%{MONTH:month} %{MONTHDAY:day} %{TIME:time} %{WORD:logsource} %{SYSLOGPROG} ?\[%{WORD:pid}?]: %{WORD:ovpn.client}/%{IP:ovpn.source.ip}:%{WORD:ovpn.source.port} %{WORD}: %{WORD} %{WORD} %{WORD} %{WORD} %{WORD}/%{IP}:%{WORD}: %{IP:ovpn.internal.ip}"
			}
			add_tag => ["Connected"]
		}
		if "_grokparsefailure" in [tags] {
			drop { }
		}
	}
	else if "TLS Error:" in [message] {	# Обрыв связи, проблемы сети
		grok {
			match => {
				"message" => "%{MONTH:month} %{MONTHDAY:day} %{TIME:time} %{WORD:logsource} %{SYSLOGPROG} ?\[%{WORD:pid}?]: %{WORD}/%{IP}:%{WORD:port} %{GREEDYDATA:ovpn.error.event}: %{GREEDYDATA:ovpn.error.message}"
			}
			add_tag => ["TLS Error"]
		}
		if "_grokparsefailure" in [tags] {
			drop { }
		}
	}
	else if "TLS Error: cannot locate" in [message] {	# Попытки подключения левых юзеров
		grok {
			match => {
				"message" => "%{MONTH:month} %{MONTHDAY:day} %{TIME:time} %{WORD:logsource} %{SYSLOGPROG} ?\[%{WORD:pid}?]: %{GREEDYDATA:ovpn.error.event}: %{GREEDYDATA:ovpn.error.message} %{WORD} ?\[%{WORD}?]%{IP:ovpn.source.ip}:%{WORD:ovpn.source.port}"
			}
			add_tag => ["cannot locate"]
		}
		if "_grokparsefailure" in [tags]
		{
			drop { }
		}
	}
	else if "VERIFY ERROR" in [message] {	# Сертификат клиента - ВСЁ
		grok {
			match => { 
				"message" => "%{MONTH:month} %{MONTHDAY:day} %{TIME:time} %{WORD:logsource} %{SYSLOGPROG} ?\[%{WORD:pid}?]: %{IP:ovpn.source.ip}:%{WORD:ovpn.source.port} %{GREEDYDATA:ovpn.error.event}: %{WORD}=%{GREEDYDATA}, error=%{GREEDYDATA:ovpn.error.message}: %{WORD}=%{WORD:ovpn.client}"
			}
			add_tag => ["VERIFY ERROR"]
		}
		if "_grokparsefailure" in [tags] {
			drop { }
		}
	}
	else {
		drop { }
	}
}

################# OUTPUT #################

output {
#	elasticsearch {
#		hosts => ['192.168.15.77:9200']
#	}
##### DEBUG OSTI D'CALISSE DE TABARNAK!!! ##### Отправка в разные файлы для гребанного дебага
	if "Connected" in [tags] {
		file {
			path => "/tmp/vpn_connected.json"
			codec => "json_lines"
		}
	}
	else if "TLS Error" in [tags] {
		file {
			path => "/tmp/vpn_tls.json"
			codec => "json_lines"
		}
	}
	else if "cannot locate" in [tags] {
		file {
			path => "/tmp/vpn_cannot.json"
			codec => "json_lines"
		}
	}
	else if "VERIFY ERROR" in [tags] {
		file {
			path => "/tmp/vpn_verify.json"
			codec => "json_lines"
		}
	}
	else if "Client OS" in [tags] {
		file {
			path => "/tmp/vpn_os.json"
			codec => "json_lines"
		}
	}
	else if "IV_GUI_VER=" in [tags] {
		file {
			path => "/tmp/vpn_gui.json"
			codec => "json_lines"
		}
	}
	else {
		file {
			path => "/tmp/else.json"
			codec => "json_lines"
		}
	}
	
}