Question

我需要Logstash的一些帮助。我目前有以下Logstash配置工作。当[message]标签有＆＃34;令牌验证失败＆＃34;在其中它发送一封电子邮件说出auth问题。

 input {

  tcp {
    codec => "json"
    port => 5144
    tags => ["windows","nxlog"]
    type => "nxlog-json"
  }

} # end input

filter {

  if [type] == "nxlog-json" {
    date {
      match => ["[EventTime]", "YYYY-MM-dd HH:mm:ss"]
      timezone => "Europe/London"
    }
    mutate {
        rename => [ "AccountName", "user" ]
        rename => [ "AccountType", "[eventlog][account_type]" ]
        rename => [ "ActivityId", "[eventlog][activity_id]" ]
        rename => [ "Address", "ip6" ]
        rename => [ "ApplicationPath", "[eventlog][application_path]" ]
        rename => [ "AuthenticationPackageName", "[eventlog][authentication_package_name]" ]
        rename => [ "Category", "[eventlog][category]" ]
        rename => [ "Channel", "[eventlog][channel]" ]
        rename => [ "Domain", "domain" ]
        rename => [ "EventID", "[eventlog][event_id]" ]
        rename => [ "EventType", "[eventlog][event_type]" ]
        rename => [ "File", "[eventlog][file_path]" ]
        rename => [ "Guid", "[eventlog][guid]" ]
        rename => [ "Hostname", "hostname" ]
        rename => [ "Interface", "[eventlog][interface]" ]
        rename => [ "InterfaceGuid", "[eventlog][interface_guid]" ]
        rename => [ "InterfaceName", "[eventlog][interface_name]" ]
        rename => [ "IpAddress", "ip" ]
        rename => [ "IpPort", "port" ]
        rename => [ "Key", "[eventlog][key]" ]
        rename => [ "LogonGuid", "[eventlog][logon_guid]" ]
        rename => [ "Message", "message" ]
        rename => [ "ModifyingUser", "[eventlog][modifying_user]" ]
        rename => [ "NewProfile", "[eventlog][new_profile]" ]
        rename => [ "OldProfile", "[eventlog][old_profile]" ]
        rename => [ "Port", "port" ]
        rename => [ "PrivilegeList", "[eventlog][privilege_list]" ]
        rename => [ "ProcessID", "pid" ]
        rename => [ "ProcessName", "[eventlog][process_name]" ]
        rename => [ "ProviderGuid", "[eventlog][provider_guid]" ]
        rename => [ "ReasonCode", "[eventlog][reason_code]" ]
        rename => [ "RecordNumber", "[eventlog][record_number]" ]
        rename => [ "ScenarioId", "[eventlog][scenario_id]" ]
        rename => [ "Severity", "level" ]
        rename => [ "SeverityValue", "[eventlog][severity_code]" ]
        rename => [ "SourceModuleName", "nxlog_input" ]
        rename => [ "SourceName", "[eventlog][program]" ]
        rename => [ "SubjectDomainName", "[eventlog][subject_domain_name]" ]
        rename => [ "SubjectLogonId", "[eventlog][subject_logonid]" ]
        rename => [ "SubjectUserName", "[eventlog][subject_user_name]" ]
        rename => [ "SubjectUserSid", "[eventlog][subject_user_sid]" ]
        rename => [ "System", "[eventlog][system]" ]
        rename => [ "TargetDomainName", "[eventlog][target_domain_name]" ]
        rename => [ "TargetLogonId", "[eventlog][target_logonid]" ]
        rename => [ "TargetUserName", "[eventlog][target_user_name]" ]
        rename => [ "TargetUserSid", "[eventlog][target_user_sid]" ]
        rename => [ "ThreadID", "thread" ]

    }
    mutate {
        remove_field => [
                    "CurrentOrNextState",
                    "Description",
                    "EventReceivedTime",
                    "EventTime",
                    "EventTimeWritten",
                    "IPVersion",
                    "KeyLength",
                    "Keywords",
                    "LmPackageName",
                    "LogonProcessName",
                    "LogonType",
                    "Name",
                    "Opcode",
                    "OpcodeValue",
                    "PolicyProcessingMode",
                    "Protocol",
                    "ProtocolType",
                    "SourceModuleType",
                    "State",
                    "Task",
                    "TransmittedServices",
                    "Type",
                    "UserID",
                    "Version"
                    ]
    }
  }

}

output {
   elasticsearch {
    hosts => ["localhost:9200"]
    }

if "Token validation failed" in [message]  {

email {

address => "smtp01.domain.com"
to => "example@domain.com"
from => "Sender@domain.com"
subject => "Auth Issue"
body => "Auth Issue"   
port => 25
use_tls => false
via => "smtp" 

}   
}

} # end output

我想知道如果邮件标记＆＃34;令牌验证失败＆＃34;一分钟10次。如果它有9个或更少的条目，它将不会发送任何电子邮件。我需要设置什么配置才能使其正常工作？

Answer 1

有几种方法可以实现这一目标。

一个。您可以使用XPack Alerting（以前称为Watcher）或ElastAlert，如this answer

中所述

B中。您可以使用aggregate Logstash filter来跟踪和计算“令牌验证失败”消息，如this answer中所述。你只需要

  aggregate {
    task_id => "%{[eventlog][target_logonid]}"
    code => "map['failed_count'] ||= 0; map['failed_count'] += 1;"
    push_map_as_event_on_timeout => true
    timeout => 60 # 1 minute timeout
    timeout_tags => ['_aggregatetimeout']
    timeout_code => "event.set('token_failed', event.get('failed_count') >= 10)"
  }

然后，您只能发送电子邮件if [token_failed]

℃。您可以使用ruby Logstash filter来计算和缓存“令牌验证失败”消息发生的次数。它与B基本相同，但是通过Ruby代码自己实现逻辑。

d。您可以使用metrics Logstash filter来计算消息字段中“令牌验证失败”的事件率。

  metrics {
    meter => [ "message" ]
    rates => [ 1 ]
    add_tag => "metric"
  }

然后在您的输出中，您可以简单地使用这样的计量信息：

  if "metric" in [tags] and [Token validation failed][count] >= 10 {
    email {
      ...
    }
  }

请注意，对于解决方案B和C，您无法使用more than one worker启动Logstash（即-w 1）。我已经提交enhancement request来解决这个问题，但由于Logstash团队已经拥有大量的TODO，我们会看到会发生什么。

Elkstack Logstash - 如何通过电子邮件发送阈值警报

1 个答案: