logstash-lib 1.3.2

data/lib/logstash/util/zeromq.rb

@@ -0,0 +1,47 @@
+# encoding: utf-8
+require 'ffi-rzmq'
+require "logstash/namespace"
+
+module LogStash::Util::ZeroMQ
+  CONTEXT = ZMQ::Context.new
+  # LOGSTASH-400
+  # see https://github.com/chuckremes/ffi-rzmq/blob/master/lib/ffi-rzmq/socket.rb#L93-117
+  STRING_OPTS = %w{IDENTITY SUBSCRIBE UNSUBSCRIBE}
+
+  def context
+    CONTEXT
+  end
+
+  def setup(socket, address)
+    if server?
+      error_check(socket.bind(address), "binding to #{address}")
+    else
+      error_check(socket.connect(address), "connecting to #{address}")
+    end
+    @logger.info("0mq: #{server? ? 'connected' : 'bound'}", :address => address)
+  end
+
+  def error_check(rc, doing)
+    unless ZMQ::Util.resultcode_ok?(rc)
+      @logger.error("ZeroMQ error while #{doing}", { :error_code => rc })
+      raise "ZeroMQ Error while #{doing}"
+    end
+  end # def error_check
+
+  def setopts(socket, options)
+    options.each do |opt,value|
+      sockopt = opt.split('::')[1]
+      option = ZMQ.const_defined?(sockopt) ? ZMQ.const_get(sockopt) : ZMQ.const_missing(sockopt)
+      unless STRING_OPTS.include?(sockopt)
+        begin
+          Float(value)
+          value = value.to_i
+        rescue ArgumentError
+          raise "#{sockopt} requires a numeric value. #{value} is not numeric"
+        end
+      end # end unless
+      error_check(socket.setsockopt(option, value),
+              "while setting #{opt} == #{value}")
+    end # end each
+  end # end setopts
+end # module LogStash::Util::ZeroMQ

data/lib/logstash/version.rb

@@ -0,0 +1,6 @@
+# encoding: utf-8
+# The version of logstash.
+LOGSTASH_VERSION = "1.3.2"
+
+# Note to authors: this should not include dashes because 'gem' barfs if
+# you include a dash in the version string.

data/locales/en.yml

@@ -0,0 +1,170 @@
+# YAML notes
+#   |- means 'scalar block' useful for formatted text
+#   > means 'scalar block' but it chomps all newlines. Useful 
+#     for unformatted text.
+en:
+  oops: |-
+    +---------------------------------------------------------+
+    | An unexpected error occurred. This is probably a bug.   |
+    | You can find help with this problem in a few places:    |
+    |                                                         |
+    | * chat: #logstash IRC channel on freenode irc.          |
+    |     IRC via the web: http://goo.gl/TI4Ro                |
+    | * email: logstash-users@googlegroups.com                |
+    | * bug system: https://logstash.jira.com/                |
+    |                                                         |
+    +---------------------------------------------------------+
+    The error reported is: 
+      %{error}
+  logstash:
+    pipeline:
+      worker-error: |-
+        A plugin had an unrecoverable error. Will restart this plugin.
+          Plugin: %{plugin}
+          Error: %{error}
+      worker-error-debug: |-
+        A plugin had an unrecoverable error. Will restart this plugin.
+          Plugin: %{plugin}
+          Error: %{error}
+          Exception: %{exception}
+          Stack: %{stacktrace}
+      plugin-loading-error: >-
+        Couldn't find any %{type} plugin named '%{name}'. Are you
+        sure this is correct? Trying to load the %{name} %{type} plugin
+        resulted in this error: %{error}
+      plugin-type-loading-error: >-
+        Could not find any plugin type named '%{type}'. Check for typos.
+        Valid plugin types are 'input' 'filter' and 'output'
+      output-worker-unsupported: >-
+        %{plugin} output plugin: setting 'workers => %{worker_count}' is not
+        supported by this plugin. I will continue working as if you had not set
+        this setting.
+      output-worker-unsupported-with-message: >-
+        %{plugin} output plugin: setting 'workers => %{worker_count}' is not
+        supported by this plugin. I will continue working as if you had not set
+        this setting.
+    plugin:
+      milestone:
+        "0": >-
+          Using milestone 0 %{type} plugin '%{name}'. This plugin isn't well
+          supported by the community and likely has no maintainer. For more
+          information on plugin milestones, see
+          http://logstash.net/docs/%{LOGSTASH_VERSION}/plugin-milestones
+        "1": >-
+          Using milestone 1 %{type} plugin '%{name}'. This plugin should work,
+          but would benefit from use by folks like you. Please let us know if you
+          find bugs or have suggestions on how to improve this plugin.  For more
+          information on plugin milestones, see
+          http://logstash.net/docs/%{LOGSTASH_VERSION}/plugin-milestones
+        "2": >-
+          Using milestone 2 %{type} plugin '%{name}'. This plugin should be
+          stable, but if you see strange behavior, please let us know!
+          For more information on plugin milestones, see
+          http://logstash.net/docs/%{LOGSTASH_VERSION}/plugin-milestones
+    agent:
+      sighup: >-
+        SIGHUP received.
+      missing-configuration: >-
+        No configuration file was specified. Perhaps you forgot to provide
+        the '-f yourlogstash.conf' flag?
+      error: >-
+        Error: %{error}
+      interrupted: >-
+        Interrupt received. Shutting down the pipeline.
+      configuration:
+        file-not-found: |-
+          No config files found: %{path}
+          Can you make sure this path is a logstash config file?
+        setting_missing: |-
+          Missing a required setting for the %{plugin} %{type} plugin:
+
+            %{type} {
+              %{plugin} {
+                %{setting} => # SETTING MISSING
+                ...
+              }
+            }
+        setting_invalid: |-
+          Invalid setting for %{plugin} %{type} plugin:
+
+            %{type} {
+              %{plugin} {
+                # This setting must be a %{value_type}
+                # %{note}
+                %{setting} => %{value}
+                ...
+              }
+            }
+        invalid_plugin_settings: >-
+          Something is wrong with your configuration.
+        invalid_plugin_register: >-
+          Cannot register %{plugin} %{type} plugin.
+          The error reported is: 
+            %{error}
+        plugin_path_missing: >-
+          You specified a plugin path that does not exist: %{path}
+        no_plugins_found: |-
+          Could not find any plugins in "%{path}"
+          I tried to find files matching the following, but found none: 
+            %{plugin_glob}
+        log_file_failed: |-
+          Failed to open %{path} for writing: %{error}
+
+          This is often a permissions issue, or the wrong 
+          path was specified?
+      flag:
+        # Note: Wrap these at 45 chars so they display nicely when clamp emits
+        # them in an 80-character terminal
+        config: |+
+          Load the logstash config from a specific file
+          or directory.  If a direcory is given, all
+          files in that directory will be concatonated
+          in lexicographical order and then parsed as a
+          single config file. You can also specify
+          wildcards (globs) and any matched files will
+          be loaded in the order described above.
+        config-string: |+
+          Use the given string as the configuration
+          data. Same syntax as the config file. If not
+          input is specified, then 'stdin { type =>
+          stdin }' is the default input. If no output
+          is specified, then 'stdout { debug => true
+          }}' is default output.
+        filterworkers: |+
+          Sets the number of filter workers to run.
+        watchdog-timeout: |+
+          Set the filter watchdog timeout (in seconds).
+          This timeout is used to detect stuck filters;
+          stuck filters usually symptoms of bugs.
+          When a filter takes longer than TIMEOUT
+          seconds, it will cause logstash to abort.
+        log: |+
+          Write logstash internal logs to the given
+          file. Without this flag, logstash will emit
+          logs to standard output.
+        verbosity: |+
+          Increase verbosity of logstash internal logs.
+          Specifying once will show 'informational'
+          logs. Specifying twice will show 'debug'
+          logs. This flag is deprecated. You should use
+          --verbose or --debug instead.
+        version: |+
+          Emit the version of logstash and its friends,
+          then exit.
+        pluginpath: |+
+          A path of where to find plugins. This flag
+          can be given multiple times to include
+          multiple paths. Plugins are expected to be
+          in a specific directory hierarchy:
+          'PATH/logstash/TYPE/NAME.rb' where TYPE is
+          'input' 'filter' or 'output' and NAME is the
+          name of the plugin.
+        quiet: |+
+          Quieter logstash logging. This causes only 
+          errors to be emitted.
+        verbose: |+
+          More verbose logging. This causes 'info' 
+          level logs to be emitted.
+        debug: |+
+          Most verbose logging. This causes 'debug'
+          level logs to be emitted.

data/logstash-event.gemspec

@@ -0,0 +1,29 @@
+# -*- encoding: utf-8 -*-
+Gem::Specification.new do |gem|
+  gem.authors       = ["Jordan Sissel"]
+  gem.email         = ["jls@semicomplete.com"]
+  gem.description   = %q{Library that contains the classes required to create LogStash events}
+  gem.summary       = %q{Library that contains the classes required to create LogStash events}
+  gem.homepage      = "https://github.com/logstash/logstash"
+  gem.license       = "Apache License (2.0)"
+
+  gem.files = %w{
+    lib/logstash-event.rb
+    lib/logstash/event.rb
+    lib/logstash/namespace.rb
+    lib/logstash/util/fieldreference.rb
+    lib/logstash/util.rb
+    spec/event.rb
+    LICENSE
+  }
+
+  gem.test_files    = []
+  gem.name          = "logstash-event"
+  gem.require_paths = ["lib"]
+  gem.version       = "1.2.02"
+  
+  gem.add_development_dependency "rspec"
+  gem.add_development_dependency "guard"
+  gem.add_development_dependency "guard-rspec"
+  gem.add_development_dependency "insist", "1.0.0"
+end

data/logstash.gemspec

@@ -0,0 +1,128 @@
+# -*- encoding: utf-8 -*-
+require File.expand_path('../lib/logstash/version', __FILE__)
+
+Gem::Specification.new do |gem|
+  gem.authors       = ["Jordan Sissel", "Pete Fritchman"]
+  gem.email         = ["jls@semicomplete.com", "petef@databits.net"]
+  gem.description   = %q{scalable log and event management (search, archive, pipeline)}
+  gem.summary       = %q{logstash - log and event management}
+  gem.homepage      = "http://logstash.net/"
+  gem.license       = "Apache License (2.0)"
+
+  gem.files         = `git ls-files`.split($\)
+  gem.test_files    = gem.files.grep(%r{^(test|spec|features)/})
+  gem.name          = "logstash"
+  gem.require_paths = ["lib"]
+  gem.version       = LOGSTASH_VERSION
+
+  # Core dependencies
+  gem.add_runtime_dependency "cabin", [">=0.6.0"]   #(Apache 2.0 license)
+  gem.add_runtime_dependency "json"               #(ruby license)
+  gem.add_runtime_dependency "minitest"           # for running the tests from the jar, (MIT license)
+  gem.add_runtime_dependency "pry"                #(ruby license)
+  gem.add_runtime_dependency "stud"               #(Apache 2.0 license)
+  gem.add_runtime_dependency "clamp"              # for command line args/flags (MIT license)
+  gem.add_runtime_dependency "i18n"               #(MIT license)
+
+  # Web dependencies
+  gem.add_runtime_dependency "ftw", ["~> 0.0.39"] #(Apache 2.0 license)
+  gem.add_runtime_dependency "haml"               #(MIT license)
+  gem.add_runtime_dependency "rack"               #(MIT license)
+  gem.add_runtime_dependency "sass"               #(MIT license)
+  gem.add_runtime_dependency "sinatra"            #(MIT license)
+  gem.add_runtime_dependency "mime-types"         #(GPL 2.0)
+
+  # Input/Output/Filter dependencies
+  #TODO Can these be optional?
+  gem.add_runtime_dependency "awesome_print"                    #(MIT license)
+  gem.add_runtime_dependency "aws-sdk"                          #{Apache 2.0 license}  
+  gem.add_runtime_dependency "google-api-client"                #{Apache 2.0 license}
+  gem.add_runtime_dependency "heroku"                           #(MIT license)
+  gem.add_runtime_dependency "addressable"                      #(Apache 2.0 license)
+  gem.add_runtime_dependency "extlib", ["0.9.16"]               #(MIT license)
+  gem.add_runtime_dependency "elasticsearch"                    #(Apache 2.0 license)
+  gem.add_runtime_dependency "ffi"                              #(LGPL-3 license)
+  gem.add_runtime_dependency "ffi-rzmq", ["1.0.0"]              #(MIT license)
+  gem.add_runtime_dependency "filewatch", ["0.5.1"]             #(BSD license)
+  gem.add_runtime_dependency "gelfd", ["0.2.0"]                 #(Apache 2.0 license)
+  gem.add_runtime_dependency "gelf", ["1.3.2"]                  #(MIT license)
+  gem.add_runtime_dependency "gmetric", ["0.1.3"]               #(MIT license)
+  gem.add_runtime_dependency "jiralicious", ["0.2.2"]           #(MIT license)
+  gem.add_runtime_dependency "jls-grok", ["0.10.12"]            #(BSD license)
+  gem.add_runtime_dependency "mail"                             #(MIT license)
+  gem.add_runtime_dependency "mongo"                            #(Apache 2.0 license)
+  gem.add_runtime_dependency "metriks"                          #(MIT license)
+  gem.add_runtime_dependency "onstomp"                          #(Apache 2.0 license)
+  gem.add_runtime_dependency "redis"                            #(MIT license)
+  gem.add_runtime_dependency "riak-client", ["1.0.3"]           #(Apache 2.0 license)
+  gem.add_runtime_dependency "riemann-client", ["0.2.1"]        #(MIT license)
+  gem.add_runtime_dependency "statsd-ruby", ["1.2.0"]           #(MIT license)
+  gem.add_runtime_dependency "uuidtools"                        # For generating amqp queue names (Apache 2.0 license)
+  gem.add_runtime_dependency "xml-simple"                       #(ruby license?)
+  gem.add_runtime_dependency "xmpp4r", ["0.5"]                  #(ruby license)
+  gem.add_runtime_dependency "jls-lumberjack", [">=0.0.19"]     #(Apache 2.0 license)
+  gem.add_runtime_dependency "geoip", [">= 1.3.2"]              #(GPL license)
+  gem.add_runtime_dependency "beefcake", "0.3.7"                #(MIT license)
+  gem.add_runtime_dependency "php-serialize"                    # For input drupal_dblog (MIT license)
+  gem.add_runtime_dependency "murmurhash3"                      #(MIT license)
+  gem.add_runtime_dependency "rufus-scheduler", "~> 2.0.24"     #(MIT license)
+  gem.add_runtime_dependency "user_agent_parser", [">= 2.0.0"]  #(MIT license)
+  gem.add_runtime_dependency "snmp"                             #(ruby license)
+  gem.add_runtime_dependency "varnish-rb"                       #(MIT license)
+  gem.add_runtime_dependency "mail"                             #(MIT license)
+  gem.add_runtime_dependency "rbnacl"                           #(MIT license)
+  gem.add_runtime_dependency "sequel"                           #(MIT license)
+  gem.add_runtime_dependency "jdbc-sqlite3"                     #(MIT license)
+  gem.add_runtime_dependency "bindata", [">= 1.5.0"]            #(ruby license)
+  gem.add_runtime_dependency "twitter", "5.0.0.rc.1"            #(MIT license)
+  gem.add_runtime_dependency "rsolr"                            #(Apache 2.0 license)
+  gem.add_runtime_dependency "edn"                              #(MIT license)
+
+  if RUBY_PLATFORM == 'java'
+    gem.platform = RUBY_PLATFORM
+    gem.add_runtime_dependency "jruby-elasticsearch", ["0.0.17"]  #(BSD license)
+    gem.add_runtime_dependency "jruby-httpclient"                 #(Apache 2.0 license)
+    gem.add_runtime_dependency "bouncy-castle-java", "1.5.0147"   #(MIT license)
+    gem.add_runtime_dependency "jruby-openssl", "0.8.7"           #(CPL/GPL/LGPL license)
+    gem.add_runtime_dependency "jruby-win32ole"                   #(unknown license)
+    gem.add_runtime_dependency "jdbc-mysql"                       # For input drupal_dblog (BSD license)
+    gem.add_runtime_dependency "msgpack-jruby"                    #(Apache 2.0 license)
+  else
+    gem.add_runtime_dependency "excon"    #(MIT license)
+    gem.add_runtime_dependency "mysql2"   # For input drupal_dblog (MIT license)
+    gem.add_runtime_dependency "msgpack"  #(Apache 2.0 license)
+  end
+
+  if RUBY_PLATFORM != 'java'
+    gem.add_runtime_dependency "bunny",       ["~> 1.0.5"]  #(MIT license)
+  else
+    gem.add_runtime_dependency "march_hare", ["~> 2.0.0"] #(MIT license)
+  end
+
+  if RUBY_VERSION >= '1.9.1'
+    gem.add_runtime_dependency "cinch" # cinch requires 1.9.1+ #(MIT license)
+  end
+
+  if RUBY_ENGINE == "rbx"
+    # rubinius puts the ruby stdlib into gems.
+    gem.add_runtime_dependency "rubysl"
+
+    # Include racc to make the xml tests pass.
+    # https://github.com/rubinius/rubinius/issues/2632#issuecomment-26954565
+    gem.add_runtime_dependency "racc"
+  end
+
+  # These are runtime-deps so you can do 'java -jar logstash.jar rspec <test>'
+  gem.add_runtime_dependency "spoon"            #(Apache 2.0 license)
+  gem.add_runtime_dependency "mocha"            #(MIT license)
+  gem.add_runtime_dependency "shoulda"          #(MIT license)
+  gem.add_runtime_dependency "rspec"            #(MIT license)
+  gem.add_runtime_dependency "insist", "1.0.0"  #(Apache 2.0 license)
+  gem.add_runtime_dependency "rumbster"         # For faking smtp in email tests (Apache 2.0 license)
+  
+  #Development Deps
+  gem.add_development_dependency "coveralls"
+
+  #Jenkins Deps
+  gem.add_runtime_dependency "ci_reporter"
+end

data/patterns/firewalls

@@ -0,0 +1,60 @@
+# NetScreen firewall logs
+NETSCREENSESSIONLOG %{SYSLOGTIMESTAMP:date} %{IPORHOST:device} %{IPORHOST}: NetScreen device_id=%{WORD:device_id}%{DATA}: start_time=%{QUOTEDSTRING:start_time} duration=%{INT:duration} policy_id=%{INT:policy_id} service=%{DATA:service} proto=%{INT:proto} src zone=%{WORD:src_zone} dst zone=%{WORD:dst_zone} action=%{WORD:action} sent=%{INT:sent} rcvd=%{INT:rcvd} src=%{IPORHOST:src_ip} dst=%{IPORHOST:dst_ip} src_port=%{INT:src_port} dst_port=%{INT:dst_port} src-xlated ip=%{IPORHOST:src_xlated_ip} port=%{INT:src_xlated_port} dst-xlated ip=%{IPORHOST:dst_xlated_ip} port=%{INT:dst_xlated_port} session_id=%{INT:session_id} reason=%{GREEDYDATA:reason}
+
+#== Cisco ASA ==
+CISCO_TAGGED_SYSLOG ^<%{POSINT:syslog_pri}>%{CISCOTIMESTAMP:timestamp}( %{SYSLOGHOST:sysloghost})?: %%{CISCOTAG:ciscotag}:
+CISCOTIMESTAMP %{MONTH} +%{MONTHDAY}(?: %{YEAR})? %{TIME}
+CISCOTAG [A-Z0-9]+-%{INT}-(?:[A-Z0-9_]+)
+# Common Particles
+CISCO_ACTION Built|Teardown|Deny|Denied|denied|requested|permitted|denied by ACL|discarded|est-allowed|Dropping|created|deleted
+CISCO_REASON Duplicate TCP SYN|Failed to locate egress interface|Invalid transport field|No matching connection|DNS Response|DNS Query|(?:%{WORD}\s*)*
+CISCO_DIRECTION Inbound|inbound|Outbound|outbound
+CISCO_INTERVAL first hit|%{INT}-second interval
+CISCO_XLATE_TYPE static|dynamic
+# ASA-2-106001
+CISCOFW106001 %{CISCO_DIRECTION:direction} %{WORD:protocol} connection %{CISCO_ACTION:action} from %{IP:src_ip}/%{INT:src_port} to %{IP:dst_ip}/%{INT:dst_port} flags %{GREEDYDATA:tcp_flags} on interface %{GREEDYDATA:interface}
+# ASA-2-106006, ASA-2-106007, ASA-2-106010
+CISCOFW106006_106007_106010 %{CISCO_ACTION:action} %{CISCO_DIRECTION:direction} %{WORD:protocol} (?:from|src) %{IP:src_ip}/%{INT:src_port}(\(%{DATA:src_fwuser}\))? (?:to|dst) %{IP:dst_ip}/%{INT:dst_port}(\(%{DATA:dst_fwuser}\))? (?:on interface %{DATA:interface}|due to %{CISCO_REASON:reason})
+# ASA-3-106014
+CISCOFW106014 %{CISCO_ACTION:action} %{CISCO_DIRECTION:direction} %{WORD:protocol} src %{DATA:src_interface}:%{IP:src_ip}(\(%{DATA:src_fwuser}\))? dst %{DATA:dst_interface}:%{IP:dst_ip}(\(%{DATA:dst_fwuser}\))? \(type %{INT:icmp_type}, code %{INT:icmp_code}\)
+# ASA-6-106015
+CISCOFW106015 %{CISCO_ACTION:action} %{WORD:protocol} \(%{DATA:policy_id}\) from %{IP:src_ip}/%{INT:src_port} to %{IP:dst_ip}/%{INT:dst_port} flags %{DATA:tcp_flags}  on interface %{GREEDYDATA:interface}
+# ASA-1-106021
+CISCOFW106021 %{CISCO_ACTION:action} %{WORD:protocol} reverse path check from %{IP:src_ip} to %{IP:dst_ip} on interface %{GREEDYDATA:interface}
+# ASA-4-106023
+CISCOFW106023 %{CISCO_ACTION:action} %{WORD:protocol} src %{DATA:src_interface}:%{IP:src_ip}(/%{INT:src_port})?(\(%{DATA:src_fwuser}\))? dst %{DATA:dst_interface}:%{IP:dst_ip}(/%{INT:dst_port})?(\(%{DATA:dst_fwuser}\))?( \(type %{INT:icmp_type}, code %{INT:icmp_code}\))? by access-group %{DATA:policy_id} \[%{DATA:hashcode1}, %{DATA:hashcode2}\]
+# ASA-5-106100
+CISCOFW106100 access-list %{WORD:policy_id} %{CISCO_ACTION:action} %{WORD:protocol} %{DATA:src_interface}/%{IP:src_ip}\(%{INT:src_port}\)(\(%{DATA:src_fwuser}\))? -> %{DATA:dst_interface}/%{IP:dst_ip}\(%{INT:dst_port}\)(\(%{DATA:src_fwuser}\))? hit-cnt %{INT:hit_count} %{CISCO_INTERVAL:interval} \[%{DATA:hashcode1}, %{DATA:hashcode2}\]
+# ASA-6-110002
+CISCOFW110002 %{CISCO_REASON:reason} for %{WORD:protocol} from %{DATA:src_interface}:%{IP:src_ip}/%{INT:src_port} to %{IP:dst_ip}/%{INT:dst_port}
+# ASA-6-302010
+CISCOFW302010 %{INT:connection_count} in use, %{INT:connection_count_max} most used
+# ASA-6-302013, ASA-6-302014, ASA-6-302015, ASA-6-302016
+CISCOFW302013_302014_302015_302016 %{CISCO_ACTION:action}(?: %{CISCO_DIRECTION:direction})? %{WORD:protocol} connection %{INT:connection_id} for %{DATA:src_interface}:%{IP:src_ip}/%{INT:src_port}( \(%{IP:src_mapped_ip}/%{INT:src_mapped_port}\))?(\(%{DATA:src_fwuser}\))? to %{DATA:dst_interface}:%{IP:dst_ip}/%{INT:dst_port}( \(%{IP:dst_mapped_ip}/%{INT:dst_mapped_port}\))?(\(%{DATA:dst_fwuser}\))?( duration %{TIME:duration} bytes %{INT:bytes})?(?: %{CISCO_REASON:reason})?( \(%{DATA:user}\))?
+# ASA-6-302020, ASA-6-302021
+CISCOFW302020_302021 %{CISCO_ACTION:action}(?: %{CISCO_DIRECTION:direction})? %{WORD:protocol} connection for faddr %{IP:dst_ip}/%{INT:icmp_seq_num}(?:\(%{DATA:fwuser}\))? gaddr %{IP:src_xlated_ip}/%{INT:icmp_code_xlated} laddr %{IP:src_ip}/%{INT:icmp_code}( \(%{DATA:user}\))?
+# ASA-6-305011
+CISCOFW305011 %{CISCO_ACTION:action} %{CISCO_XLATE_TYPE:xlate_type} %{WORD:protocol} translation from %{DATA:src_interface}:%{IP:src_ip}(/%{INT:src_port})?(\(%{DATA:src_fwuser}\))? to %{DATA:src_xlated_interface}:%{IP:src_xlated_ip}/%{DATA:src_xlated_port}
+# ASA-3-313001, ASA-3-313004, ASA-3-313008
+CISCOFW313001_313004_313008 %{CISCO_ACTION:action} %{WORD:protocol} type=%{INT:icmp_type}, code=%{INT:icmp_code} from %{IP:src_ip} on interface %{DATA:interface}( to %{IP:dst_ip})?
+# ASA-4-313005
+CISCOFW313005 %{CISCO_REASON:reason} for %{WORD:protocol} error message: %{WORD:err_protocol} src %{DATA:err_src_interface}:%{IP:err_src_ip}(\(%{DATA:err_src_fwuser}\))? dst %{DATA:err_dst_interface}:%{IP:err_dst_ip}(\(%{DATA:err_dst_fwuser}\))? \(type %{INT:err_icmp_type}, code %{INT:err_icmp_code}\) on %{DATA:interface} interface\.  Original IP payload: %{WORD:protocol} src %{IP:orig_src_ip}/%{INT:orig_src_port}(\(%{DATA:orig_src_fwuser}\))? dst %{IP:orig_dst_ip}/%{INT:orig_dst_port}(\(%{DATA:orig_dst_fwuser}\))?
+# ASA-4-402117
+CISCOFW402117 %{WORD:protocol}: Received a non-IPSec packet \(protocol= %{WORD:orig_protocol}\) from %{IP:src_ip} to %{IP:dst_ip}
+# ASA-4-402119
+CISCOFW402119 %{WORD:protocol}: Received an %{WORD:orig_protocol} packet \(SPI= %{DATA:spi}, sequence number= %{DATA:seq_num}\) from %{IP:src_ip} \(user= %{DATA:user}\) to %{IP:dst_ip} that failed anti-replay checking
+# ASA-4-419001
+CISCOFW419001 %{CISCO_ACTION:action} %{WORD:protocol} packet from %{DATA:src_interface}:%{IP:src_ip}/%{INT:src_port} to %{DATA:dst_interface}:%{IP:dst_ip}/%{INT:dst_port}, reason: %{GREEDYDATA:reason}
+# ASA-4-419002
+CISCOFW419002 %{CISCO_REASON:reason} from %{DATA:src_interface}:%{IP:src_ip}/%{INT:src_port} to %{DATA:dst_interface}:%{IP:dst_ip}/%{INT:dst_port} with different initial sequence number
+# ASA-4-500004
+CISCOFW500004 %{CISCO_REASON:reason} for protocol=%{WORD:protocol}, from %{IP:src_ip}/%{INT:src_port} to %{IP:dst_ip}/%{INT:dst_port}
+# ASA-6-602303, ASA-6-602304
+CISCOFW602303_602304 %{WORD:protocol}: An %{CISCO_DIRECTION:direction} %{GREEDYDATA:tunnel_type} SA \(SPI= %{DATA:spi}\) between %{IP:src_ip} and %{IP:dst_ip} \(user= %{DATA:user}\) has been %{CISCO_ACTION:action}
+# ASA-7-710001, ASA-7-710002, ASA-7-710003, ASA-7-710005, ASA-7-710006
+CISCOFW710001_710002_710003_710005_710006 %{WORD:protocol} (?:request|access) %{CISCO_ACTION:action} from %{IP:src_ip}/%{INT:src_port} to %{DATA:dst_interface}:%{IP:dst_ip}/%{INT:dst_port}
+# ASA-6-713172
+CISCOFW713172 Group = %{GREEDYDATA:group}, IP = %{IP:src_ip}, Automatic NAT Detection Status:\s+Remote end\s*%{DATA:is_remote_natted}\s*behind a NAT device\s+This\s+end\s*%{DATA:is_local_natted}\s*behind a NAT device
+# ASA-4-733100
+CISCOFW733100 \[\s*%{DATA:drop_type}\s*\] drop %{DATA:drop_rate_id} exceeded. Current burst rate is %{INT:drop_rate_current_burst} per second, max configured rate is %{INT:drop_rate_max_burst}; Current average rate is %{INT:drop_rate_current_avg} per second, max configured rate is %{INT:drop_rate_max_avg}; Cumulative total count is %{INT:drop_total_count}
+#== End Cisco ASA ==

data/patterns/grok-patterns

@@ -0,0 +1,91 @@
+USERNAME [a-zA-Z0-9._-]+
+USER %{USERNAME}
+INT (?:[+-]?(?:[0-9]+))
+BASE10NUM (?<![0-9.+-])(?>[+-]?(?:(?:[0-9]+(?:\.[0-9]+)?)|(?:\.[0-9]+)))
+NUMBER (?:%{BASE10NUM})
+BASE16NUM (?<![0-9A-Fa-f])(?:[+-]?(?:0x)?(?:[0-9A-Fa-f]+))
+BASE16FLOAT \b(?<![0-9A-Fa-f.])(?:[+-]?(?:0x)?(?:(?:[0-9A-Fa-f]+(?:\.[0-9A-Fa-f]*)?)|(?:\.[0-9A-Fa-f]+)))\b
+
+POSINT \b(?:[1-9][0-9]*)\b
+NONNEGINT \b(?:[0-9]+)\b
+WORD \b\w+\b
+NOTSPACE \S+
+SPACE \s*
+DATA .*?
+GREEDYDATA .*
+QUOTEDSTRING (?>(?<!\\)(?>"(?>\\.|[^\\"]+)+"|""|(?>'(?>\\.|[^\\']+)+')|''|(?>`(?>\\.|[^\\`]+)+`)|``))
+UUID [A-Fa-f0-9]{8}-(?:[A-Fa-f0-9]{4}-){3}[A-Fa-f0-9]{12}
+
+# Networking
+MAC (?:%{CISCOMAC}|%{WINDOWSMAC}|%{COMMONMAC})
+CISCOMAC (?:(?:[A-Fa-f0-9]{4}\.){2}[A-Fa-f0-9]{4})
+WINDOWSMAC (?:(?:[A-Fa-f0-9]{2}-){5}[A-Fa-f0-9]{2})
+COMMONMAC (?:(?:[A-Fa-f0-9]{2}:){5}[A-Fa-f0-9]{2})
+IPV6 ((([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){6}(:[0-9A-Fa-f]{1,4}|((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){5}(((:[0-9A-Fa-f]{1,4}){1,2})|:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){4}(((:[0-9A-Fa-f]{1,4}){1,3})|((:[0-9A-Fa-f]{1,4})?:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){3}(((:[0-9A-Fa-f]{1,4}){1,4})|((:[0-9A-Fa-f]{1,4}){0,2}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){2}(((:[0-9A-Fa-f]{1,4}){1,5})|((:[0-9A-Fa-f]{1,4}){0,3}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){1}(((:[0-9A-Fa-f]{1,4}){1,6})|((:[0-9A-Fa-f]{1,4}){0,4}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(:(((:[0-9A-Fa-f]{1,4}){1,7})|((:[0-9A-Fa-f]{1,4}){0,5}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:)))(%.+)?
+IPV4 (?<![0-9])(?:(?:25[0-5]|2[0-4][0-9]|[0-1]?[0-9]{1,2})[.](?:25[0-5]|2[0-4][0-9]|[0-1]?[0-9]{1,2})[.](?:25[0-5]|2[0-4][0-9]|[0-1]?[0-9]{1,2})[.](?:25[0-5]|2[0-4][0-9]|[0-1]?[0-9]{1,2}))(?![0-9])
+IP (?:%{IPV6}|%{IPV4})
+HOSTNAME \b(?:[0-9A-Za-z][0-9A-Za-z-]{0,62})(?:\.(?:[0-9A-Za-z][0-9A-Za-z-]{0,62}))*(\.?|\b)
+HOST %{HOSTNAME}
+IPORHOST (?:%{HOSTNAME}|%{IP})
+HOSTPORT (?:%{IPORHOST=~/\./}:%{POSINT})
+
+# paths
+PATH (?:%{UNIXPATH}|%{WINPATH})
+UNIXPATH (?>/(?>[\w_%!$@:.,-]+|\\.)*)+
+TTY (?:/dev/(pts|tty([pq])?)(\w+)?/?(?:[0-9]+))
+WINPATH (?>[A-Za-z]+:|\\)(?:\\[^\\?*]*)+
+URIPROTO [A-Za-z]+(\+[A-Za-z+]+)?
+URIHOST %{IPORHOST}(?::%{POSINT:port})?
+# uripath comes loosely from RFC1738, but mostly from what Firefox
+# doesn't turn into %XX
+URIPATH (?:/[A-Za-z0-9$.+!*'(){},~:;=@#%_\-]*)+
+#URIPARAM \?(?:[A-Za-z0-9]+(?:=(?:[^&]*))?(?:&(?:[A-Za-z0-9]+(?:=(?:[^&]*))?)?)*)?
+URIPARAM \?[A-Za-z0-9$.+!*'|(){},~@#%&/=:;_?\-\[\]]*
+URIPATHPARAM %{URIPATH}(?:%{URIPARAM})?
+URI %{URIPROTO}://(?:%{USER}(?::[^@]*)?@)?(?:%{URIHOST})?(?:%{URIPATHPARAM})?
+
+# Months: January, Feb, 3, 03, 12, December
+MONTH \b(?:Jan(?:uary)?|Feb(?:ruary)?|Mar(?:ch)?|Apr(?:il)?|May|Jun(?:e)?|Jul(?:y)?|Aug(?:ust)?|Sep(?:tember)?|Oct(?:ober)?|Nov(?:ember)?|Dec(?:ember)?)\b
+MONTHNUM (?:0?[1-9]|1[0-2])
+MONTHDAY (?:(?:0[1-9])|(?:[12][0-9])|(?:3[01])|[1-9])
+
+# Days: Monday, Tue, Thu, etc...
+DAY (?:Mon(?:day)?|Tue(?:sday)?|Wed(?:nesday)?|Thu(?:rsday)?|Fri(?:day)?|Sat(?:urday)?|Sun(?:day)?)
+
+# Years?
+YEAR (?>\d\d){1,2}
+HOUR (?:2[0123]|[01]?[0-9])
+MINUTE (?:[0-5][0-9])
+# '60' is a leap second in most time standards and thus is valid.
+SECOND (?:(?:[0-5][0-9]|60)(?:[:.,][0-9]+)?)
+TIME (?!<[0-9])%{HOUR}:%{MINUTE}(?::%{SECOND})(?![0-9])
+# datestamp is YYYY/MM/DD-HH:MM:SS.UUUU (or something like it)
+DATE_US %{MONTHNUM}[/-]%{MONTHDAY}[/-]%{YEAR}
+DATE_EU %{MONTHDAY}[./-]%{MONTHNUM}[./-]%{YEAR}
+ISO8601_TIMEZONE (?:Z|[+-]%{HOUR}(?::?%{MINUTE}))
+ISO8601_SECOND (?:%{SECOND}|60)
+TIMESTAMP_ISO8601 %{YEAR}-%{MONTHNUM}-%{MONTHDAY}[T ]%{HOUR}:?%{MINUTE}(?::?%{SECOND})?%{ISO8601_TIMEZONE}?
+DATE %{DATE_US}|%{DATE_EU}
+DATESTAMP %{DATE}[- ]%{TIME}
+TZ (?:[PMCE][SD]T|UTC)
+DATESTAMP_RFC822 %{DAY} %{MONTH} %{MONTHDAY} %{YEAR} %{TIME} %{TZ}
+DATESTAMP_OTHER %{DAY} %{MONTH} %{MONTHDAY} %{TIME} %{TZ} %{YEAR}
+
+# Syslog Dates: Month Day HH:MM:SS
+SYSLOGTIMESTAMP %{MONTH} +%{MONTHDAY} %{TIME}
+PROG (?:[\w._/%-]+)
+SYSLOGPROG %{PROG:program}(?:\[%{POSINT:pid}\])?
+SYSLOGHOST %{IPORHOST}
+SYSLOGFACILITY <%{NONNEGINT:facility}.%{NONNEGINT:priority}>
+HTTPDATE %{MONTHDAY}/%{MONTH}/%{YEAR}:%{TIME} %{INT}
+
+# Shortcuts
+QS %{QUOTEDSTRING}
+
+# Log formats
+SYSLOGBASE %{SYSLOGTIMESTAMP:timestamp} (?:%{SYSLOGFACILITY} )?%{SYSLOGHOST:logsource} %{SYSLOGPROG}:
+COMMONAPACHELOG %{IPORHOST:clientip} %{USER:ident} %{USER:auth} \[%{HTTPDATE:timestamp}\] "(?:%{WORD:verb} %{NOTSPACE:request}(?: HTTP/%{NUMBER:httpversion})?|%{DATA:rawrequest})" %{NUMBER:response} (?:%{NUMBER:bytes}|-)
+COMBINEDAPACHELOG %{COMMONAPACHELOG} %{QS:referrer} %{QS:agent}
+
+# Log Levels
+LOGLEVEL ([A-a]lert|ALERT|[T|t]race|TRACE|[D|d]ebug|DEBUG|[N|n]otice|NOTICE|[I|i]nfo|INFO|[W|w]arn?(?:ing)?|WARN?(?:ING)?|[E|e]rr?(?:or)?|ERR?(?:OR)?|[C|c]rit?(?:ical)?|CRIT?(?:ICAL)?|[F|f]atal|FATAL|[S|s]evere|SEVERE|EMERG(?:ENCY)?|[Ee]merg(?:ency)?)