### DNS parcer for Suricata log
#
# Читаем локальный файл, пишем в Elastic
#
#
input {
	file {
		path => [ "/var/log/suricata/dns.log" ]
		sincedb_path => "/dev/null"
		start_position => "beginning" #Поменять на end#
	}
}

filter {
	##### Simple DNS query #####
	if "Query" in [message] and "AAAA" not in [message] {
		grok {
			match => {
				"message" => "%{GREEDYDATA:timestamp}  ?\[?\*?\*?\] %{WORD:dns.message.type} %{WORD} %{WORD} ?\[?\*?\*?\] %{HOSTNAME:dns.request} ?\[?\*?\*?\] %{WORD:dns.record.type} ?\[?\*?\*?\] %{IP:dns.client.ip}:%{WORD:dns.client.port} %{GREEDYDATA} %{IP:dns.server.ip}:%{WORD:dns.server.port}"
			}
		}
		if "_grokparsefailure" in [tags] {
			drop { }
		}
	}
	if "Query" in [message] and "AAAA" in [message] {
		grok {
			match => {
				"message" => "%{GREEDYDATA:timestamp}  ?\[?\*?\*?\] %{WORD:dns.message.type} %{WORD} %{WORD} ?\[?\*?\*?\] %{DATA:dns.request} ?\[?\*?\*?\] %{WORD:dns.record.type} ?\[?\*?\*?\] %{IP:dns.client.ip}:%{WORD:dns.client.port} %{GREEDYDATA} %{IP:dns.server.ip}:%{WORD:dns.server.port}"
			}
		}
		if "_grokparsefailure" in [tags] {
			drop { }
		}
	}
	##### Simple DNS response #####
	else if "Response" in [message] and "AAAA" not in [message] and "CNAME" not in [message] {
		grok {
			match => {
				"message" => "%{GREEDYDATA:timestamp}  ?\[?\*?\*?\] %{WORD:dns.message.type} %{WORD} %{WORD} ?\[?\*?\*?\] %{DATA:dns.request} ?\[?\*?\*?\] %{WORD:dns.record.type} ?\[?\*?\*?\] %{WORD} %{WORD:dns.ttl} ?\[?\*?\*?\] %{DATA:dns.reply.ip} ?\[?\*?\*?\] %{IP:dns.server.ip}:%{WORD:dns.server.port} %{GREEDYDATA} %{IP:dns.client.ip}:%{WORD:dns.client.port}"
			}
			add_tag => ["ip.v4"]			
		}
		geoip {
			source => "dns.reply.ip"
		}
		if "_grokparsefailure" in [tags] {
			drop { }
		}
	}
	##### IPv6 DNS response #####
	else if "Response" in [message] and "AAAA" in [message] and "CNAME" not in [message] {
		grok {
			match => {
				"message" => "%{GREEDYDATA:timestamp}  ?\[?\*?\*?\] %{WORD:dns.message.type} %{WORD} %{WORD} ?\[?\*?\*?\] %{DATA:dns.request} ?\[?\*?\*?\] %{WORD:dns.record.type} ?\[?\*?\*?\] %{WORD} %{WORD:dns.ttl} ?\[?\*?\*?\] %{DATA:dns.reply.ip} ?\[?\*?\*?\] %{IP:dns.server.ip}:%{WORD:dns.server.port} %{GREEDYDATA} %{IP:dns.client.ip}:%{WORD:dns.client.port}"
			}
			add_tag => ["ip.v6"]
		}
		if "_grokparsefailure" in [tags] {
			drop {}
		}
	}
	##### IPv4 DNS response with CNAME ######
	else if "Response" in [message] and "AAAA" not in [message] and "CNAME" in [message] {
		grok {
			match => {
				"message" => "%{GREEDYDATA:timestamp}  ?\[?\*?\*?\] %{WORD:dns.message.type} %{WORD} %{WORD} ?\[?\*?\*?\] %{HOSTNAME:dns.cname.response} ?\[?\*?\*?\] %{WORD:dns.record.type} ?\[?\*?\*?\] %{WORD} %{WORD:dns.ttl} ?\[?\*?\*?\] %{HOSTNAME:dns.name.orig} ?\[?\*?\*?\] %{IP:dns.server.ip}:%{WORD:dns.server.port} %{GREEDYDATA} %{IP:dns.client.ip}:%{WORD:dns.client.port}"
			}
		}
		if "_grokparsefailure" in [tags] {
			drop {}
		}
	}
# гребанный timestam....
	date {
		match => ["timestamp", "MM/dd/yyyy-HH:mm:ss.SSSSSS"]
        timezone => "America/Toronto"
        target => ["@timestamp"]
    }
}
output {
        elasticsearch {
                hosts => ['IP этого сранного эластик-сервака:9200']
        }
}