Skip to content

Commit

Permalink
CEF changes (elastic#7320)
Browse files Browse the repository at this point in the history
  • Loading branch information
untergeek authored and Suyog Rao committed Jun 5, 2017
1 parent f443dae commit 5509359
Showing 2 changed files with 14 additions and 1 deletion.
8 changes: 7 additions & 1 deletion logstash-core/lib/logstash/config/source/multi_local.rb
Original file line number Diff line number Diff line change
@@ -30,11 +30,17 @@ def pipeline_configs
def match?
uses_config_string = @original_settings.get_setting("config.string").set?
uses_path_config = @original_settings.get_setting("path.config").set?
return true if !uses_config_string && !uses_path_config
uses_modules_cli = @original_settings.get_setting("modules.cli").set?
uses_modules_yml = @original_settings.get_setting("modules").set?
return true if !uses_config_string && !uses_path_config && !uses_modules_cli && !uses_modules_yml
if uses_path_config
logger.warn("Ignoring the 'pipelines.yml' file because 'path.config' (-f) is being used.")
elsif uses_config_string
logger.warn("Ignoring the 'pipelines.yml' file because 'config.string' (-e) is being used.")
elsif uses_modules_cli
logger.warn("Ignoring the 'pipelines.yml' file because 'modules.cli' (--modules) is being used.")
elsif uses_modules_yml
logger.warn("Ignoring the 'pipelines.yml' file because modules are defined in the 'logstash.yml' file.")
end
false
end
7 changes: 7 additions & 0 deletions modules/cef/configuration/logstash/cef.conf.erb
Original file line number Diff line number Diff line change
@@ -8,6 +8,13 @@ input {
}

filter {

# Map the @timestamp with the event time, as recorded in deviceReceiptTime

date {
match => [ "deviceReceiptTime", "MMM dd yyyy HH:mm:ss", "MMM d yyyy HH:mm:ss", "UNIX_MS" ]
}

# To map the attacker Geo IP if plausible

geoip {

0 comments on commit 5509359

Please sign in to comment.