Alex-Devera/tpotce
1
0
Fork 0
mirror of https://github.com/telekom-security/tpotce.git synced 2025-07-04 14:02:13 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Fix logstash logging issue, introduced with Sentrypeer 4.0.4

Browse source 
Similar to #1807
This commit is contained in:
t3chn0m4g3 2025-07-03 10:48:18 +02:00
parent c556d02a30
commit 6faf600d40
2 changed files with 14 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
docker/elk/logstash/dist/http_output.conf vendored
View file

@ -698,12 +698,15 @@ filter {
remove_field => ["event_timestamp"] remove_field => ["event_timestamp"]
} }
mutate { mutate {
rename => { split => ["source_ip", ":"]
"source_ip" => "src_ip" rename => { "destination_ip" => "dest_ip" }
"destination_ip" => "dest_ip"
}
add_field => { "dest_port" => "5060" } add_field => { "dest_port" => "5060" }
} }
mutate {
add_field => { "src_ip" => "%{[source_ip][0]}" }
add_field => { "src_port" => "%{[source_ip][1]}" }
remove_field => ["source_ip"]
}
} }
# Tanner # Tanner

11
docker/elk/logstash/dist/logstash.conf vendored
View file

@ -698,12 +698,15 @@ filter {
remove_field => ["event_timestamp"] remove_field => ["event_timestamp"]
} }
mutate { mutate {
rename => { split => ["source_ip", ":"]
"source_ip" => "src_ip" rename => { "destination_ip" => "dest_ip" }
"destination_ip" => "dest_ip"
}
add_field => { "dest_port" => "5060" } add_field => { "dest_port" => "5060" }
} }
mutate {
add_field => { "src_ip" => "%{[source_ip][0]}" }
add_field => { "src_port" => "%{[source_ip][1]}" }
remove_field => ["source_ip"]
}
} }
# Tanner # Tanner