SIEM

siem-elastic-template/elastic/parsers.conf

@@ -0,0 +1,7 @@
+[PARSER]
+    Name        http_access_custom
+    Format      regex
+    Regex       ^(?<host>\S+)\s+(?<ident>\S+)\s+(?<user>\S+)\s+\[(?<time>[^\]]+)\]\s+"(?<method>\S+)\s+(?<path>\S+)\s+(?<protocol>[^"]+)"\s+(?<code>\d{3})\s+(?<size>\S+)$
+    Time_Key    time
+    Time_Format %d/%b/%Y %H:%M:%S
+    Types       code:integer