logstash.conf

input { 
  #stdin { } 
  file {
    path => "/opt/nsm/bro/logs/current/*.log"   
    sincedb_path => "/opt/nsm/bro/logs/current/*.log"
    start_position => "beginning" 
  }
}

filter {
  if [message] =~ /^(\d+\.\d{6}\s+\S+\s+(?:[\d\.]+|[\w:]+|-)\s+(?:\d+|-)\s+(?:[\d\.]+|[\w:]+|-)\s+(?:\d+|-)\s+\S+\s+\S+\s+\S+\s+\S+\s+[^:]+::\S+\s+[^:]+::\S+\s+\S+(?:\s\S+)*$)/ {
    grok{
      patterns_dir => "/etc/logstash/custom_patterns"
      match => {
        message => "%{291009}"
      }
      add_field => [ "rule_id", "291009" ]
      add_field => [ "Device Type", "IPSIDSDevice" ]
      add_field => [ "Object", "Process" ]
      add_field => [ "Action", "General" ]
      add_field => [ "Status", "Informational" ]
    }
  }
  translate { 
    field => "evt_dstip"
    destination => "tor_IP"
    dictionary_path => '/etc/logstash/translate/torIP.yaml'
  }
  translate { 
    field => "evt_srcip"
    destination => "tor_IP"
    dictionary_path => '/etc/logstash/translate/torIP.yaml'
  }  
  translate { 
    field => "evt_dstip"
    destination => "malicious_IP"
    dictionary_path => '/etc/logstash/translate/maliciousIP.yaml'
  }
  translate { 
    field => "evt_srcip"
    destination => "malicious_IP"
    dictionary_path => '/etc/logstash/translate/maliciousIP.yaml'
  }  
  date {
    match => [ "start_time", "UNIX" ]
  }
}

output { 
  stdout { 
    codec => rubydebug 
  }
  if [tor_IP] == "YES" {
   email  {
        address => "SMTP_HOST"
        from => "EMAIL_USER"
        htmlbody => "Traffic has been detected coming from or going to a TOR Exit Node IP address.  <br/><br/>
<b>Source IP: </b>%{evt_srcip}<br/>
<b>Source Port: </b>%{evt_srcport}<br/>
<b>Destination IP: </b>%{evt_dstip}<br/>
<b>Destination Port: </b>%{evt_dstport}<br/><br/>
<b>Raw Log: </b>%{message}"
        password => "EMAIL_PASS"
        port => SMTP_PORT
        subject => "Tor Exit IP Detected by SweetSecurity"
        to => "EMAIL_USER"
        use_tls => true
        username => "EMAIL_USER"
     }
  }
  
  if [malicious_IP] == "YES" {
   email  {
        address => "SMTP_HOST"
        from => "EMAIL_USER"
        htmlbody => "Traffic has been detected coming from or going to a malicious IP address.  <br/><br/>
<b>Source IP: </b>%{evt_srcip}<br/>
<b>Source Port: </b>%{evt_srcport}<br/>
<b>Destination IP: </b>%{evt_dstip}<br/>
<b>Destination Port: </b>%{evt_dstport}<br/><br/>
<b>Raw Log: </b>%{message}"
        password => "EMAIL_PASS"
        port => SMTP_PORT
        subject => "Malicious IP Detected by SweetSecurity"
        to => "EMAIL_USER"
        use_tls => true
        username => "EMAIL_USER"
     }
  }

  elasticsearch { 
    hosts => localhost 
  } 
}