Merge remote-tracking branch 'upstream/master' into feature-modularize

Conflicts:
	logstash-modsecurity.conf

Author: Lucas Bremgartner

1010_input_file_example.conf

@@ -1,9 +1,7 @@
 input {
-
   file {
     # IMPORTANT! set this correctly to the charset
     # that your server writes these log files in
-    charset => "US-ASCII"
     path => "/path/to/your/modsec/audit/logs/*.log"
     type => "mod_security"
 
@@ -13,10 +11,10 @@ input {
     # which is the end of each modsec logical event in the logfile
     #~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     codec => multiline {
+      charset => "US-ASCII"
       pattern => "^--[a-fA-F0-9]{8}-Z--$"
       negate => true
       what => previous
     }
   }
-
 }

2020_filter_section_b_parse_request_line.conf

@@ -7,23 +7,12 @@ filter {
     #~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
     # if a legit line... normal http request
-    if [rawSectionB] =~ /.*?\s\S+\s.+\n{1}/ {
-
-      grok {
-        match => {
-          "rawSectionB" => "%{DATA:httpMethod}\s(?<requestedUri>\S+)\s(?<incomingProtocol>.+?)\n{1}"
-        }
-        patterns_dir => "./patterns/logstash_modsecurity_patterns"
-      }
-
-    # not a legit line.. invalid http request, grab first line and dump in the httpMethod
-    } else {
-
+    if [rawSectionB] =~ /.+/ {
       grok {
         match => {
-          "rawSectionB" => "(?<httpMethod>^(.*)$)"
+          "rawSectionB" => [  "(?m)^%{DATA:httpMethod}\s(?<requestedUri>\S+)\s(?<incomingProtocol>[^\n]+)(?:\n(?<raw_requestHeaders>.+)?)?$",
+                              "(?<httpMethod>^(.*)$)" ]
         }
-        patterns_dir => "./patterns/logstash_modsecurity_patterns"
       }
     }
   }

…_filter_section_b_headers_key-value.conf …_filter_section_b_headers_key-value.conf2022_filter_section_b_headers_key-value.conf renamed to 2021_filter_section_b_headers_key-value.conf 2022_filter_section_b_headers_key-value.conf renamed to 2021_filter_section_b_headers_key-value.conf

@@ -12,7 +12,6 @@ filter {
         match => {
           "raw_requestHeaders" => "(?<myCookie>myCookie[^; \s]+)"
         }
-        patterns_dir => "./patterns/logstash_modsecurity_patterns"
       }
     }
   }

2021_filter_section_b_parse_headers.conf

@@ -16,7 +16,6 @@ filter {
         match => {
           "raw_requestHeaders" => "X-Forwarded-For: %{IPORHOST:XForwardedFor}"
         }
-        patterns_dir => "./patterns/logstash_modsecurity_patterns"
       }
     }
   }

2029_filter_section_b_example_header_Cookie.conf

@@ -0,0 +1,18 @@
+filter {
+  if [type] == "mod_security" {
+    #~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+    # Example of splitting all Cookies from the requestHeader Cookie
+    # and promoting it to a first class field
+    #~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+      if [requestHeaders][Cookie] =~ /.+/ {
+          kv {
+              source => "[requestHeaders][Cookie]"
+              field_split => "; "
+              value_split => "="
+              target => "requestCookies"
+          }
+      }
+    }
+  }
+}

2029_filter_section_b_example_header_X-Forwarded-For.conf

@@ -10,8 +10,7 @@ filter {
       grok {
         match => {
           "rawSectionC" => "(?<requestBody>.+)"
-         }
-        patterns_dir => "./patterns/logstash_modsecurity_patterns"
+        }
       }
     }
   }

2029_filter_section_b_example_splitt_all_cockies.conf

@@ -5,24 +5,12 @@ filter {
     # Parse out server protocol/HTTP status from Section F (response related, line 1)
     #~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
-     # response section (NO headers)
-    if [rawSectionF] =~ /(.+?)\s(.+?)$/ {
-      grok {
-        singles => true
-        match => {
-          "rawSectionF" => "(?<serverProtocol>.+?)\s(?<responseStatus>.+?)$"
-        }
-        patterns_dir => "./patterns/logstash_modsecurity_patterns"
-      }
+    if [rawSectionF] =~ /.+/ {
 
-    # response section (WITH headers)
-    } else if [rawSectionF] =~ /(.+?)\s(.+?)\n{1}/ {
       grok {
-        singles => true
         match => {
-          "rawSectionF" => "(?<serverProtocol>.+?)\s(?<responseStatus>.+?)\n{1}"
+          "rawSectionF" => "(?m)^(?<serverProtocol>.+?)\s(?<responseStatus>[^\n]+)(\n(?<raw_responseHeaders>.+)?)?$"
         }
-        patterns_dir => "./patterns/logstash_modsecurity_patterns"
       }
     }
   }

2030_filter_section_c_parse.conf

@@ -12,7 +12,6 @@ filter {
         match => {
           "rawSectionF" => ".+?\n(?m)(?<raw_responseHeaders>.+)"
         }
-        patterns_dir => "./patterns/logstash_modsecurity_patterns"
       }
     }
   }