76 lines
1.8 KiB
JSON
76 lines
1.8 KiB
JSON
{
|
|
"TimberWinR":{
|
|
"Inputs":{
|
|
"WindowsEvents":[
|
|
{
|
|
"source":"System,Application",
|
|
"binaryFormat":"PRINT",
|
|
"resolveSIDS":true
|
|
}
|
|
],
|
|
"Logs":[
|
|
{
|
|
"name":"Syslogs1",
|
|
"location":"C:\\Logs1\\*.log"
|
|
}
|
|
],
|
|
"IISW3CLogs":[
|
|
{
|
|
"name":"Default site",
|
|
"location":"c:\\inetpub\\logs\\LogFiles\\W3SVC1\\*"
|
|
}
|
|
]
|
|
},
|
|
"Filters":[
|
|
{
|
|
"grok":{
|
|
"condition": "[type] == \"Win32-FileLog\"",
|
|
"match":[
|
|
"Text",
|
|
""
|
|
],
|
|
"add_field":[
|
|
"host",
|
|
"%{ComputerName}"
|
|
]
|
|
}
|
|
},
|
|
{
|
|
"grok":{
|
|
"match":[
|
|
"message",
|
|
"%{SYSLOGLINE}"
|
|
],
|
|
"add_tag":[
|
|
"rn_%{Index}",
|
|
"bar"
|
|
],
|
|
"add_field":[
|
|
"foo_%{logsource}",
|
|
"Hello dude from %{ComputerName}"
|
|
]
|
|
}
|
|
},
|
|
{
|
|
"grok":{
|
|
"match":[
|
|
"Text",
|
|
"%{SYSLOGLINE}"
|
|
],
|
|
"add_tag":[
|
|
"rn_%{RecordNumber}",
|
|
"bar"
|
|
]
|
|
}
|
|
},
|
|
{
|
|
"mutate":{
|
|
"rename":[
|
|
"message",
|
|
"Message"
|
|
]
|
|
}
|
|
}
|
|
]
|
|
}
|
|
} |