input {
  beats {
        port => 5044
        ssl => false
  }
}
filter {
        if "alert TCP" in [message] {
                grok {
                        match => {
                                "message" => "%{GREEDYDATA:timestamp}   ?\[?\*?\*?\] ?\[%{INT}:%{INT}:%{INT}?\] %{GREEDYDATA:signature}  ?\[?\*?\*?\] ?\[%{WORD}: %{INT:priority}?\] ?\{%{WORD:protocol}?\} %{IP:ip.source}:%{INT:port.source} -> %{IP:ip.dst}:%{INT:port.dst}"
                        }
                }
                if "_grokparsefailure" in [tags] {
                        drop {}
                }
        }
        else if "alert ICMP" in [message] {
                grok {
                        match => {
                                "message" => "%{GREEDYDATA:timestamp}   ?\[?\*?\*?\] ?\[%{INT}:%{INT}:%{INT}?\] %{GREEDYDATA:signature}  ?\[?\*?\*?\] ?\[%{WORD}: %{INT:priority}?\] ?\{%{WORD:protocol}?\} %{IP:ip.source} -> %{IP:ip.dst}"
                        }
                }
                if "_grokparsefailure" in [tags] {
                        drop {}
                }
        }
        else {
                 grok {
                        match => {
                                "message" => "%{GREEDYDATA:timestamp}   ?\[?\*?\*?\] ?\[%{INT}:%{INT}:%{INT}?\] %{GREEDYDATA:signature}  ?\[?\*?\*?\] ?\[%{WORD}: %{GREEDYDATA:classification}?\] ?\[%{WORD}: %{INT:priority}?\] ?\{%{WORD:protocol}?\} %{IP:ip.source}:%{INT:port.source} -> %{IP:ip.dst}:%{INT:port.dst}"
                        }
                }
                if "_grokparsefailure" in [tags] {
                        drop {}
                }
        }
#    date {
#        match => ["timestamp", "MM/dd-HH:mm:ss.SSSSSS"]
#        timezone => "America/Toronto"
#        target => ["@timestamp"]
#    }
        geoip {
                source => "ip.source"
        }
        geoip {
                source => "ip.dst"
        }
}
output {
    elasticsearch {
        hosts => ['127.0.0.1:9200']
    }
}