input {
       # filebeats
       beats {
       	     port => 5044
             type => "cowrie"
       }
       beats {
             port => 5045
             type => "suricata"
       }	 
       gelf {
            use_tcp => true
            port => 9044
            type => "wids"
       }
}

filter {
    if [type] == "cowrie" {
        json {
	    source => message
	}

        date {
            match => [ "timestamp", "ISO8601" ]
        }

        if [src_ip]  {

            mutate {
                add_field => { "src_host" => "%{src_ip}" }
            }

            dns {
                reverse => [ "src_host" ]
                nameserver => [ "8.8.8.8", "8.8.4.4" ]
                action => "replace"
                hit_cache_size => 4096
                hit_cache_ttl => 900
                failed_cache_size => 512
                failed_cache_ttl => 900
            }


            geoip {
                source => "src_ip"
                target => "geoip"
                database => "/opt/GeoLite2-City.mmdb"
            }

        }
        
        mutate {
	    # cut out useless tags/fields
            remove_tag => [ "beats_input_codec_plain_applied"]
	    remove_field => [ "[log][file][path]", "[log][offset]" ]
        }
    }
    if [type] == "suricata" {
    grok {
            match => {
                "message" => "%{GREEDYDATA:timestamp}   ?\[?\*?\*?\] ?\[%{INT}:%{INT}:%{INT}?\] %{WORD} %{WORD} %{GREEDYDATA:ids.signature}  ?\[?\*?\*?\] ?\[%{WORD}: %{GREEDYDATA:ids.classification}?\] ?\[%{WORD}: %{INT:ids.severity}?\] ?\{%{WORD:ids.protocol}?\} %{IP:src_ip}:%{INT:src_port} -> %{IP:dst_ip}:%{INT:dst_port}"
            }
        }
        if "_grokparsefailure" in [tags] {
            drop {}
        }
        geoip {
            source => "src_ip"
        }
    
        geoip {
            source => "dst_ip"
        }
        date {
            match => ["timestamp", "MM/dd/yyyy-HH:mm:ss.SSSSSS "]
            timezone => "America/Toronto"
            target => ["@timestamp"]
        }
    }
}

output {
    if [type] == "cowrie" {
        elasticsearch {
            hosts => ["127.0.0.1:9200"]
	    ilm_enabled => auto
	    ilm_rollover_alias => "cowrie-logstash"
            user => logstash_internal
            password => 'P@ssw0rd'
        }
    }
    else if [type] == "suricata" {
        elasticsearch {
            hosts => ["127.0.0.1:9200"]
            ilm_enabled => auto
            ilm_rollover_alias => "suricata-logstash"
            user => logstash_internal
            password => 'P@ssw0rd'
        }
    }
    else {
         elasticsearch {
             hosts => ["127.0.0.1:9200"]
             ilm_enabled => auto
             ilm_rollover_alias => "wids-logstash"
             user => logstash_internal
             password => 'P@ssw0rd'
    }
 }
}