مدیریت لاگ متمرکز با ELK Stack روی لینوکس

filebeat.inputs:
- type: log
  paths:
    - /var/log/auth.log
  fields:
    log_type: auth
    environment: production

- type: log
  paths:
    - /var/log/nginx/access.log
  fields:
    log_type: nginx_access

output.logstash:
  hosts: ["logstash-server:5044"]

filter {
  if [fields][log_type] == "auth" {
    grok {
      match => {
        "message" => "%{SYSLOGTIMESTAMP:timestamp} %{SYSLOGHOST:host} sshd[%{POSINT:pid}]: Failed password for %{USER:failed_user} from %{IP:src_ip}"
      }
    }
    if [src_ip] {
      geoip { source => "src_ip" }
    }
  }
}