tweaking

cleanup index-pattern
add dicompot log to logstash

docker/elk/logstash/dist/logstash.conf

@@ -64,6 +64,13 @@ input {
     type => "Dionaea"
   }
 
+# Dicompot
+  file {
+    path => ["/data/dicompot/log/dicompot.log"]
+    codec => json
+    type => "Dicompot"
+  }
+
 # ElasticPot
   file {
     path => ["/data/elasticpot/log/elasticpot.json"]
@@ -298,6 +305,34 @@ filter {
     }
   }
 
+# Dicompot
+  if [type] == "Dicompot" {
+    date {
+      match => [ "time", "yyyy-MM-dd HH:mm:ss" ]
+      remove_field => ["time"]
+      remove_field => ["timestamp"]
+    }
+    mutate {
+      rename => {
+        "[Address][IP]" => "src_ip"
+        "[Address][Port]" => "src_port"
+        "[Address][Zone]" => "zone"
+        "AETitle" => "aetitle"
+        "Command" => "input"
+        "Files" => "files"
+        "Identifier" => "identifier"
+        "Matches" => "matches"
+        "Status" => "session"
+        "Version" => "version"
+      }
+    }
+    if [Address] {
+      mutate {
+        remove_field => "[Address]"
+      }
+    }
+  }
+
 # ElasticPot
   if [type] == "ElasticPot" {
     date {