input {
    rabbitmq {
        host => "10.1.6.244"
        queue => "logstash-queue"
        key => "logstash-key"
        exchange => "logstash"
        threads => 1
        exclusive => false
        prefetch_count => 256
        vhost => "elastic-stack"
        port => 5677
        user => "logstash"
        password => "fim.fpt@123456"
    }
}
filter {
   #
   # Checkpoint OPSEC/LEA event (lab)
   #
   if [type] == "checkpoint" {

      grok {
         match => { "message" => "loc=%{INT:loc}\|time=%{GREEDYDATA:timestamp}\|action=%{WORD:action}\|orig=%{IP:orig}\|i/f_dir=%{WORD:if_dir}\|i/f_name=%{DATA:if_name}\|has_accounting=%{INT:has_accounting}\|uuid=\<%{NOTSPACE:uuid}\>\|product=%{GREEDYDATA:product}\|inzone=%{WORD:inzone}\|outzone=%{WORD:outzone}\|rule=%{INT:rule}\|rule_uid=\{%{DATA:rule_uid}\}\|rule_name=%{GREEDYDATA:rule_name}\|service_id=%{WORD:service_id}\|src=%{IP:src}\|s_port=%{INT:s_port}\|dst=%{IP:dst}\|service=%{INT:service}\|proto=%{DATA:proto}\|__policy_id_tag=%{GREEDYDATA:policyidtag}\|origin_sic_name=%{GREEDYDATA:origin_sic_name}" }
      }

      grok {
         match => { "message" => "loc=%{INT:loc}\|time=%{GREEDYDATA:timestamp}\|action=%{WORD:action}\|orig=%{IP:orig}\|i/f_dir=%{WORD:if_dir}\|i/f_name=%{DATA:if_name}\|has_accounting=%{INT:has_accounting}\|uuid=\<%{NOTSPACE:uuid}\>\|product=%{GREEDYDATA:product}\|inzone=%{WORD:inzone}\|outzone=%{WORD:outzone}\|rule=%{INT:rule}\|rule_uid=\{%{DATA:rule_uid}\}\|service_id=%{WORD:service_id}\|src=%{IP:src}\|s_port=%{INT:s_port}\|dst=%{IP:dst}\|service=%{INT:service}\|proto=%{DATA:proto}\|__policy_id_tag=%{GREEDYDATA:policyidtag}\|origin_sic_name=%{GREEDYDATA:origin_sic_name}" }
      }

      grok {
         match => { "message" => "loc=%{INT:loc}\|time=%{GREEDYDATA:timestamp}\|action=%{WORD:action}\|orig=%{IP:orig}\|i/f_dir=%{WORD:if_dir}\|i/f_name=%{DATA:if_name}\|has_accounting=%{INT:has_accounting}\|uuid=\<%{NOTSPACE:uuid}\>\|product=%{GREEDYDATA:product}\|rule=%{INT:rule}\|rule_uid=\{%{DATA:rule_uid}\}\|rule_name=%{GREEDYDATA:rule_name}\|src=%{IP:src}\|s_port=%{INT:s_port}\|dst=%{IP:dst}\|service=%{INT:service}\|proto=%{DATA:proto}\|__policy_id_tag=%{GREEDYDATA:policyidtag}\|origin_sic_name=%{GREEDYDATA:origin_sic_name}" }
      }

      mutate {
         gsub => ["timestamp"," "," "]
      }
      date {
         match => [ "timestamp", "ddMMMYYYY HH:mm:ss" ]
      }
   }

}
output {
    if [type] == "checkpoint" {
        elasticsearch {
                hosts => ["http://10.1.6.195:9200", "http://10.1.6.196:9200", "http://10.1.6.197:9200"]
                user => "mirage"
                #cacert => "/etc/logstash/ca.pem"
                #ssl => true
                password => "mirage"
                manage_template => false
                index => "checkpoint-%{+YYYY.MM}"
        }
   #stdout { codec => rubydebug }
    }
}