Fixes for #17 on Logstash 1.5.x

Fixes for #17 on Logstash 1.5.x related to apparent multiline matching on "."

Author: bitsofinfo

logstash-modsecurity.conf

@@ -111,7 +111,7 @@ filter {
 
     grok {
       match => {
-        "rawSectionB" => "%{DATA:httpMethod}\s(?<requestedUri>\S+)\s(?<incomingProtocol>.+)\n{1}"
+        "rawSectionB" => "%{DATA:httpMethod}\s(?<requestedUri>\S+)\s(?<incomingProtocol>.+?)\n{1}"
       }
       patterns_dir => "./patterns/logstash_modsecurity_patterns"
     }
@@ -145,11 +145,11 @@ filter {
   # Parse out fields from Section B (request headers, line 2+)
   #~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
-  if [rawSectionB] =~ /.+\n(?m).+/ {
+  if [rawSectionB] =~ /.+?\n(?m).+/ {
 
     grok {
        match => {
-         "rawSectionB" => ".+\n(?m)(?<raw_requestHeaders>.+)"
+         "rawSectionB" => ".+?\n(?m)(?<raw_requestHeaders>.+)"
        }
        patterns_dir => "./patterns/logstash_modsecurity_patterns"
      }
@@ -177,18 +177,18 @@ filter {
       grok {
               singles => true
               match => {
-                      "rawSectionF" => "(?<serverProtocol>.+?)\s(?<responseStatus>.+)$"
+                      "rawSectionF" => "(?<serverProtocol>.+?)\s(?<responseStatus>.+?)$"
                       }
               patterns_dir => "./patterns/logstash_modsecurity_patterns"
       }
 
   # response section (WITH headers)
-  } else if [rawSectionF] =~ /(.+?)\s(.+)\n{1}/ {
+  } else if [rawSectionF] =~ /(.+?)\s(.+?)\n{1}/ {
 
     grok {
             singles => true
             match => {
-                    "rawSectionF" => "(?<serverProtocol>.+?)\s(?<responseStatus>.+)\n{1}"
+                    "rawSectionF" => "(?<serverProtocol>.+?)\s(?<responseStatus>.+?)\n{1}"
                     }
             patterns_dir => "./patterns/logstash_modsecurity_patterns"
     }
@@ -205,7 +205,7 @@ filter {
 
       grok {
         match => {
-          "rawSectionF" => ".+\n(?m)(?<raw_responseHeaders>.+)"
+          "rawSectionF" => ".+?\n(?m)(?<raw_responseHeaders>.+)"
         }
         patterns_dir => "./patterns/logstash_modsecurity_patterns"
       }