################# INPUT #################

input {	
	file {
		path => [ "/tmp/pihole/pihole.*" ]
		sincedb_path => "/dev/null"
		start_position => "beginning"
	}
}

################# FILTER #################

filter {

	if "query" in [message] {
		grok {
			match => {
				"message" => "%{MONTH:month}  %{MONTHDAY:day} %{TIME:time} %{SYSLOGPROG} ?\[%{WORD:pid}?]: %{WORD:pihole.dns.message.type}?\[%{WORD:pihole.dns.record.type}?] %{GREEDYDATA:pihole.dns.request} %{WORD} %{IP:pihole.dns.client.ip}"
			}
		}		
		if "_grokparsefailure" in [tags] {
			drop { }
		}
	}

	else if "forwarded" in [message] {
		grok {
			match => {
				"message" => "%{MONTH:month}  %{MONTHDAY:day} %{TIME:time} %{SYSLOGPROG} ?\[%{WORD:pid}?]: %{WORD:pihole.dns.message.type} %{GREEDYDATA:pihole.dns.request} %{WORD} %{IP:pihole.dns.server.ip}"
			}
		}
		if "_grokparsefailure" in [tags] {
			drop { }
		}
	}

	else if "reply" in [message] and "<CNAME>" in [message] {
		grok {
			match => {
				"message" => "%{MONTH:month}  %{MONTHDAY:day} %{TIME:time} %{SYSLOGPROG} ?\[%{WORD:pid}?]: %{WORD:pihole.dns.message.type} %{GREEDYDATA:pihole.dns.request} %{WORD} ?\<%{WORD:pihole.dns.record.type}?\>"
			}
		}
		if "_grokparsefailure" in [tags] {
			drop { }
		}
	}

	else if "reply" in [message] and "<CNAME>" not in [message]{
		grok {
			match => {
				"message" => "%{MONTH:month}  %{MONTHDAY:day} %{TIME:time} %{SYSLOGPROG} ?\[%{WORD:pid}?]: %{WORD:pihole.dns.message.type} %{GREEDYDATA:pihole.dns.request} %{WORD} %{IP:pihole.dns.reply.ip}"
			}
		}
		geoip {
			source => "pihole.dns.reply.ip"
		}
		if "_grokparsefailure" in [tags] {
			drop { }
		}
	}

	else if "cached" in [message] and "<CNAME>" in [message] {
		grok {
			match => {
				"message" => "%{MONTH:month}  %{MONTHDAY:day} %{TIME:time} %{SYSLOGPROG} ?\[%{WORD:pid}?]: %{WORD:pihole.dns.message.type} %{GREEDYDATA:pihole.dns.request} %{WORD} ?\<%{WORD:pihole.dns.record.type}?\>"
			}
		}
		if "_grokparsefailure" in [tags] {
			drop { }
		}
	}
	
	else if "cached" in [message] and "NXDOMAIN" not in [message] {
	
		grok {
			match => {
				"message" => "%{MONTH:month}  %{MONTHDAY:day} %{TIME:time} %{SYSLOGPROG} ?\[%{WORD:pid}?]: %{WORD:pihole.dns.message.type} %{GREEDYDATA:pihole.dns.request} %{WORD} %{IP:pihole.dns.reply.ip}"
			}
		}
		
		if "_grokparsefailure" in [tags] {
			grok {
				match => {
					"message" => "%{MONTH:month}  %{MONTHDAY:day} %{TIME:time} %{SYSLOGPROG} ?\[%{WORD:pid}?]: %{WORD:pihole.dns.message.type} %{IP:pihole.dns.reply.ip} %{WORD} %{GREEDYDATA:pihole.dns.request}"
				}
			}
		}
		
		else "_grokparsefailure" in [tags] {
			drop { }
		}
	}

	else {
		drop { }
	}
}

################# OUTPUT #################

output {
	elasticsearch {
		hosts => ['192.168.15.77:9200']
	}
}