Cat-Scale-logstash.conf

input {

	file {
		path => [ "/logs/*/extracted/*/Logs/varlogs/cron*" ]
		start_position => beginning
		tags => "logcron"
		sincedb_path => "/dev/null"
	}
	
	file { 
		path => [ "/logs/*/extracted/*/User_Files/hidden-user-home-dir/*/bash_aliases" ]
		start_position => beginning
		tags => "bash_aliases"
		sincedb_path => "/dev/null"
	}
	
	file {
		path => [ "/logs/*/extracted/*/Logs/varlogs/secure*" ]
		start_position => beginning
		tags => "logsecure"
		sincedb_path => "/dev/null"
	}
	file {
		path => [ "/logs/*/extracted/*/Logs/varlogs/messages*" ]
		start_position => beginning
		tags => "logmessages"
		sincedb_path => "/dev/null"
	}
	
	file {
		path => [ "/logs/*/extracted/*/Logs/varlogs/yum*" ]
		start_position => beginning
		tags => "logyum"
		sincedb_path => "/dev/null"
	}
	
	file {
		path => [ "/logs/*/extracted/*/Logs/varlogs/httpd/access_log*" ]
		start_position => beginning
		tags => "loghttpdaccess"
		sincedb_path => "/dev/null"
	}
	
	file {
		path => [ "/logs/*/extracted/*/Logs/varlogs/httpd/error_log*" ]
		start_position => beginning
		tags => "loghttpderror"
		sincedb_path => "/dev/null"
	}
	file {
		path => [ "/logs/*/extracted/*/Logs/varlogs/httpd/ssl_access_log*" ]
		start_position => beginning
		tags => "loghttpdssl_access"
		sincedb_path => "/dev/null"
	}
	file {
		path => [ "/logs/*/extracted/*/Logs/varlogs/httpd/ssl_error_log*" ]
		start_position => beginning
		tags => "loghttpdssl_access"
		sincedb_path => "/dev/null"
	}
	file {
		path => [ "/logs/*/extracted/*/Logs/varlogs/httpd/ssl_request_log*" ]
		start_position => beginning
		tags => "loghttpdssl_request"
		sincedb_path => "/dev/null"
	}
	file {
		path => [ "/logs/*/extracted/*/Logs/varlogs/audit/audit*" ]
		start_position => beginning
		tags => "logaudit"
		sincedb_path => "/dev/null"
	}
	
	file { 
		path => [ "/logs/*/extracted/*/Process_and_Network/*-netstat-an.txt" ]
		start_position => beginning
		tags => "netstat-an"
		sincedb_path => "/dev/null"
	}
	
	file { 
		path => [ "/logs/*/extracted/*/Process_and_Network/*-netstat-antup.txt" ]
		start_position => beginning
		tags => "netstat-antup"
		sincedb_path => "/dev/null"
	}
	file { 
		path => [ "/logs/*/extracted/*/Process_and_Network/*-netstat-pvWanoee.txt" ]
		start_position => beginning
		tags => "netstat-pvWanoee"
		sincedb_path => "/dev/null"
	}
	file {
		path => [ "/logs/*/extracted/*/Logs/*-last-btmp.txt" ]
		start_position => beginning
		tags => "last-btmp"
		sincedb_path => "/dev/null"
	}
	file {
		path => [ "/logs/*/extracted/*/Logs/*-lastlog.txt" ]
		start_position => beginning
		tags => "lastlog"
		sincedb_path => "/dev/null"
	}
	file {
		path => [ "/logs/*/extracted/*/Logs/*-last-wtmp.txt" ]
		start_position => beginning
		tags => "last-wtmp"
		sincedb_path => "/dev/null"
	}
	file {
		path => [ "/logs/*/extracted/*/Persistence/*-persistence-systemdlist.txt" ]
		start_position => beginning
		codec => multiline {
			pattern => "^[UNIT]"
			negate => "true"
			what => "previous"
			max_lines => 45000
			auto_flush_interval => 200
		}
		tags => "persistencesystemdlist"
		sincedb_path => "/dev/null"
	}
	file {
		path => [ "/logs/*/extracted/*/Misc/*-pot-webshell-first-1000.txt" ]
		start_position => beginning
		tags => "potwebshell1000"
		sincedb_path => "/dev/null"
		codec => multiline {
			pattern => "==>%{SPACE}%{GREEDYDATA:FullPath} <=="
			negate => true
			what => "previous"
		}
	}
	file {
		path => [ "/logs/*/extracted/*/Misc/*-pot-webshell-hashes.txt" ]
		start_position => beginning
		tags => "potwebshellhashes"
		sincedb_path => "/dev/null"
	}
	file { 
		path => [ "/logs/*/extracted/*/User_Files/hidden-user-home-dir/*/bash_history" ]
		start_position => beginning
		tags => "bashhistory"
		sincedb_path => "/dev/null"
	}
	file { 
		path => [ "/logs/*/extracted/*/User_Files/hidden-user-home-dir/*/bash_logout" ]
		start_position => beginning
		tags => "bash_logout"
		sincedb_path => "/dev/null"
	}
	file { 
		path => [ "/logs/*/extracted/*/User_Files/hidden-user-home-dir/*/profile" ]
		start_position => beginning
		tags => "bashprofile"
		sincedb_path => "/dev/null"
	}
	file { 
		path => [ "/logs/*/extracted/*/User_Files/hidden-user-home-dir/*/bashrc" ]
		start_position => beginning
		tags => "bashrc"
		sincedb_path => "/dev/null"
	}
	file { 
		path => [ "/logs/*/extracted/*/Misc/*-binhashes.txt" ]
		start_position => beginning
		tags => "binhashes"
		sincedb_path => "/dev/null"
	}
	file {
		path => [ "/logs/*/extracted/*/System_Info/*-cpuinfo.txt" ]
		start_position => beginning
		tags => "cpuinfo"
		sincedb_path => "/dev/null"
		codec => multiline {
		  pattern => "processor.*"
		  negate => true
		  what => "previous"
		}
	}
	file {
		path => [ "/logs/*/extracted/*/Persistence/*-cron-tab-list.txt" ]
		start_position => beginning
		codec => multiline {
			pattern => "^ENDOFUSERCRON$"
			negate => "true"
			what => "next"
			max_lines => 15000
			auto_flush_interval => 10
		}
		tags => "crontablist"
		sincedb_path => "/dev/null"
	}
	file {
		path => [ "/logs/*/extracted/*/Misc/*-dev-dir-files.txt" ]
		start_position => beginning
		tags => "devdirfiles"
		sincedb_path => "/dev/null"
	}
	
	file {
		path => [ "/logs/*/extracted/*/Misc/*-dev-dir-files-hashes.txt" ]
		start_position => beginning
		tags => "devdirfileshashes"
		sincedb_path => "/dev/null"
	}
	file {
		path => [ "/logs/*/extracted/*/Misc/*-exec-perm-files.txt" ]
		start_position => beginning
		tags => "execpermfiles"
		sincedb_path => "/dev/null"
	}
	file {
		path => [ "/logs/*/extracted/*/Misc/*-full-timeline.csv" ]
		start_position => beginning
		tags => "fulltimeline"
		sincedb_path => "/dev/null"
	}
	file { 
		path => [ "/logs/*/extracted/*/System_Info/*-host-date-timezone.txt" ]
		start_position => beginning
		tags => "hostdateandtime"
		sincedb_path => "/dev/null"
	}
	file {
		path => [ "/logs/*/extracted/*/Process_and_Network/*-ifconfig-a.txt" ]
		start_position => beginning
		codec => multiline {
			pattern => "^%{GREEDYDATA:Interface_Name}:%{SPACE}%{GREEDYDATA:Interface_Details}"
			negate => "true"
			what => "previous"
			max_lines => 45000
			auto_flush_interval => 5
		}
		tags => "ifconfig-a"
		sincedb_path => "/dev/null"
	}
	file {
		path => [ "/logs/*/extracted/*/Process_and_Network/*-ip-a.txt" ]
		start_position => beginning
		codec => multiline {
			pattern => "^%{NUMBER:Interface_no}:%{GREEDYDATA:Interface_Details}"
			negate => "true"
			what => "previous"
			max_lines => 45000
			auto_flush_interval => 5
		}
		tags => "ip_a"
		sincedb_path => "/dev/null"
	}
	file {
		path => [ "/logs/*/extracted/*/Process_and_Network/*-iptables.txt" ]
		start_position => beginning
		codec => multiline {
			pattern => "^Chain %{WORD:ChainType} \(policy %{WORD:Policy}\)"
			negate => "true"
			what => "previous"
			max_lines => 45000
			auto_flush_interval => 5
		}
		tags => "iptables"
		sincedb_path => "/dev/null"
	}
	file {
		path => [ "/logs/*/extracted/*/Process_and_Network/*/.ssh/known_hosts" ]
		start_position => beginning
		tags => "knownhosts"
		sincedb_path => "/dev/null"
	}
	file {
		path => [ "/logs/*/extracted/*/Process_and_Network/*-processhashes.txt" ]
		start_position => beginning
		tags => "processhashes"
		sincedb_path => "/dev/null"
	}
	file { 
		path => [ "/logs/*/extracted/*/System_Info/*-release.txt" ]
		start_position => beginning
		tags => "release"
		sincedb_path => "/dev/null"
	}
	file { 
		path => [ "/logs/*/extracted/*/Process_and_Network/*-routetable.txt" ]
		start_position => beginning
		tags => "routetable"
		sincedb_path => "/dev/null"
	}
	file {
		path => [ "/logs/*/extracted/*/Process_and_Network/*-selinux.txt" ]
		start_position => beginning
		tags => "selinux"
		sincedb_path => "/dev/null"
	}
	file {
		path => [ "/logs/*/extracted/*/Misc/*-Setuid-Setguid-tools.txt" ]
		start_position => beginning
		tags => "setuidsetguid"
		sincedb_path => "/dev/null"
	}
	file { 
		path => [ "/logs/*/extracted/*/Process_and_Network/*-ss-anepo.txt" ]
		start_position => beginning
		tags => "ss-anepo"
		sincedb_path => "/dev/null"
	}
	file {
		path => [ "/logs/*/extracted/*/Persistence/*-systemctl_all.txt" ]
		start_position => beginning
		tags => "systemctlall"
		sincedb_path => "/dev/null"
	}
	file {
		path => [ "/logs/*/extracted/*/Persistence/*-systemctl_service_status.txt" ]
		start_position => beginning
		tags => "systemctlstatus"
		sincedb_path => "/dev/null"
	}
	file {
		path => [ "/logs/*/extracted/*/User_Files/hidden-user-home-dir/*/viminfo" ]
		start_position => beginning
		codec => multiline {
			pattern => "^#%{GREEDYDATA:Section}"
			negate => "true"
			what => "previous"
			max_lines => 15000
			auto_flush_interval => 5
		}
		tags => "viminfo"
		sincedb_path => "/dev/null"
	}
	file {
		path => [ "/logs/*/extracted/*/Logs/*-whoandwhat.txt" ]
		start_position => beginning
		tags => "whoandwhat"
		sincedb_path => "/dev/null"
	}
	file { 
		path => [ "/logs/*/extracted/*/Process_and_Network/*/.ssh/authorized_keys" ]
		start_position => beginning
		tags => "authorized_keys"
		sincedb_path => "/dev/null"
	}
	file {
		path => [ "/logs/*/extracted/*/Process_and_Network/*-process-exe-links.txt" ]
		start_position => beginning
		tags => "processexelinks"
		sincedb_path => "/dev/null"
	}
	file {
		path => [ "/logs/*/extracted/*/Process_and_Network/*-process-file-links.txt" ]
		start_position => beginning
		tags => "processfilelinks"
		sincedb_path => "/dev/null"
	}
	file {
		path => [ "/logs/*/extracted/*/Process_and_Network/*-processes-axwwSo.txt" ]
		start_position => beginning
		tags => "processes-axwwso"
		sincedb_path => "/dev/null"
 	}
	file {
		path => [ "/logs/*/extracted/*/Process_and_Network/*-processes-e.txt" ]
		start_position => beginning
		tags => "processes-e"
		sincedb_path => "/dev/null"
 	}
	file {
		path => [ "/logs/*/extracted/*/Process_and_Network/*-processes-eF.txt" ]
		start_position => beginning
		tags => "processes-ecapf"
		sincedb_path => "/dev/null"
 	}
	file {
		path => [ "/logs/*/extracted/*/Process_and_Network/*-processes-ef.txt" ]
		start_position => beginning
		tags => "processes-ef"
		sincedb_path => "/dev/null"
 	}
	file {
		path => [ "/logs/*/extracted/*/Process_and_Network/*-processes-auxSww.txt" ]
		start_position => beginning
		tags => "processes-auxsww"
		sincedb_path => "/dev/null"
 	}
	file {
		path => [ "/logs/*/extracted/*/Process_and_Network/*-processes-auxww.txt" ]
		start_position => beginning
		tags => "processes-auxww"
		sincedb_path => "/dev/null"
 	}
}


filter {


	
	if "logcron" in [tags] {
		grok{
			break_on_match => false
			patterns_dir => [ "/logs/patterns" ]
			match => {
				"path" => "%{GREEDYDATA}/%{GREEDYDATA:Hostname}-%{YEAR:ColYear}%{MONTHNUM:ColMonth}%{MONTHDAY:ColDay}-%{HOUR:ColHour}%{MINUTE:ColMinute}/%{GREEDYDATA}"	
				}
			add_field => [ "CollectionDateTime", "%{ColYear}-%{ColMonth}-%{ColDay} %{ColHour}:%{ColMinute}" ]
			match => {
					"message" => "%{SYSLOGTIMESTAMP:LogTimeStamp}%{SPACE}(?<Hostname>[^ ]+)%{SPACE}%{GREEDYDATA:LogMessage}"
				}

		}
	} else if "logsecure" in [tags] {
		grok{
			patterns_dir => [ "/logs/patterns" ]
			break_on_match => false
			match => {
				"path" => "%{GREEDYDATA}/%{GREEDYDATA:Hostname}-%{YEAR:ColYear}%{MONTHNUM:ColMonth}%{MONTHDAY:ColDay}-%{HOUR:ColHour}%{MINUTE:ColMinute}/%{GREEDYDATA}"	
				}
			add_field => [ "CollectionDateTime", "%{ColYear}-%{ColMonth}-%{ColDay} %{ColHour}:%{ColMinute}" ]
			match => {
					"message" => "%{SYSLOGTIMESTAMP:LogTimeStamp}%{SPACE}(?<Hostname>[^ ]+)%{SPACE}%{GREEDYDATA:LogMessage}"
				}

		}	
	} else if "logmessages" in [tags] {
		grok{
			patterns_dir => [ "/logs/patterns" ]
			break_on_match => false
			match => {
				"path" => "%{GREEDYDATA}/%{GREEDYDATA:Hostname}-%{YEAR:ColYear}%{MONTHNUM:ColMonth}%{MONTHDAY:ColDay}-%{HOUR:ColHour}%{MINUTE:ColMinute}/%{GREEDYDATA}"	
				}
			add_field => [ "CollectionDateTime", "%{ColYear}-%{ColMonth}-%{ColDay} %{ColHour}:%{ColMinute}" ]
			match => {
					"message" => "%{SYSLOGTIMESTAMP:LogTimeStamp}%{SPACE}(?<Hostname>[^ ]+)%{SPACE}%{GREEDYDATA:LogMessage}"
				}

		}	
	} else if "logyum" in [tags] {
		grok{
			break_on_match => false
			patterns_dir => [ "/logs/patterns" ]
			match => {
				"path" => "%{GREEDYDATA}/%{GREEDYDATA:Hostname}-%{YEAR:ColYear}%{MONTHNUM:ColMonth}%{MONTHDAY:ColDay}-%{HOUR:ColHour}%{MINUTE:ColMinute}/%{GREEDYDATA}"	
				}
			add_field => [ "CollectionDateTime", "%{ColYear}-%{ColMonth}-%{ColDay} %{ColHour}:%{ColMinute}" ]
			match => {
					"message" => "%{SYSLOGTIMESTAMP:LogTimeStamp}%{SPACE}%{GREEDYDATA:LogMessage}"
				}

		}	
	} else if "loghttpdaccess" in [tags] {
		grok{
			break_on_match => false
			patterns_dir => [ "/logs/patterns" ]
			match => {
				"path" => "%{GREEDYDATA}/%{GREEDYDATA:Hostname}-%{YEAR:ColYear}%{MONTHNUM:ColMonth}%{MONTHDAY:ColDay}-%{HOUR:ColHour}%{MINUTE:ColMinute}/%{GREEDYDATA}"	
				}
			add_field => [ "CollectionDateTime", "%{ColYear}-%{ColMonth}-%{ColDay} %{ColHour}:%{ColMinute}" ]
			match => {
					"message" => "%{IP:client_ip} %{USER:User} %{USER:auth} \[%{HTTPDATE:LogTimeStamp}\] \"%{WORD:method} /%{NOTSPACE:request_page} HTTP/%{NUMBER:http_version}\" %{NUMBER:server_response} "
				}

		}	
	} else if "loghttpderror" in [tags] {
		grok{
			patterns_dir => [ "/logs/patterns" ]
			break_on_match => false
			match => {
				"path" => "%{GREEDYDATA}/%{GREEDYDATA:Hostname}-%{YEAR:ColYear}%{MONTHNUM:ColMonth}%{MONTHDAY:ColDay}-%{HOUR:ColHour}%{MINUTE:ColMinute}/%{GREEDYDATA}"	
				}
			add_field => [ "CollectionDateTime", "%{ColYear}-%{ColMonth}-%{ColDay} %{ColHour}:%{ColMinute}" ]
			match => {
					"message" => "%{DAY} %{MONTH:LogMonth} %{MONTHDAY:LogMonthDay} %{TIME:LogTime} %{YEAR:LogYear}\]%{SPACE}\[(?<Application>[^ ]+)\] \[%{GREEDYDATA:Pid_Tid}\] \[client %{IPV4:ClientIP}\]%{GREEDYDATA:LogMessagge}"
				}
			add_field => [ "LogTimeStamp", "%{LogMonthDay}-%{LogMonth}-%{LogYear} %{LogTime}" ]

		}	
	} else if "loghttpdssl_access" in [tags] {
		grok{
			patterns_dir => [ "/logs/patterns" ]
			break_on_match => false
			match => {
				"path" => "%{GREEDYDATA}/%{GREEDYDATA:Hostname}-%{YEAR:ColYear}%{MONTHNUM:ColMonth}%{MONTHDAY:ColDay}-%{HOUR:ColHour}%{MINUTE:ColMinute}/%{GREEDYDATA}"	
				}
			add_field => [ "CollectionDateTime", "%{ColYear}-%{ColMonth}-%{ColDay} %{ColHour}:%{ColMinute}" ]
			match => {
					"message" => "%{IP:client_ip} %{USER:User} %{USER:auth} \[%{HTTPDATE:LogTimeStamp}\] \"%{WORD:method} /%{NOTSPACE:request_page} HTTP/%{NUMBER:http_version}\" %{NUMBER:server_response} %{NUMBER:bytes_sent}"
				}

		}	
	} else if "ssl_error_log" in [tags] {
		grok{
			patterns_dir => [ "/logs/patterns" ]
			break_on_match => false
			match => {
				"path" => "%{GREEDYDATA}/%{GREEDYDATA:Hostname}-%{YEAR:ColYear}%{MONTHNUM:ColMonth}%{MONTHDAY:ColDay}-%{HOUR:ColHour}%{MINUTE:ColMinute}/%{GREEDYDATA}"	
				}
			add_field => [ "CollectionDateTime", "%{ColYear}-%{ColMonth}-%{ColDay} %{ColHour}:%{ColMinute}" ]
			match => {
					"message" => "%{DAY} %{MONTH:LogMonth} %{MONTHDAY:LogMonthDay} %{TIME:LogTime} %{YEAR:LogYear}\]%{SPACE}\[(?<Application>[^ ]+)\] \[%{GREEDYDATA:Pid_Tid}\] \[client %{IPV4:ClientIP}\]%{GREEDYDATA:LogMessagge}"
				}
			add_field => [ "LogTimeStamp", "%{LogMonthDay}-%{LogMonth}-%{LogYear} %{LogTime}" ]
		}	
	} else if "loghttpdssl_request" in [tags] {
		grok{
			patterns_dir => [ "/logs/patterns" ]
			break_on_match => false
			match => {
				"path" => "%{GREEDYDATA}/%{GREEDYDATA:Hostname}-%{YEAR:ColYear}%{MONTHNUM:ColMonth}%{MONTHDAY:ColDay}-%{HOUR:ColHour}%{MINUTE:ColMinute}/%{GREEDYDATA}"	
				}
			add_field => [ "CollectionDateTime", "%{ColYear}-%{ColMonth}-%{ColDay} %{ColHour}:%{ColMinute}" ]
			match => {
					"message" => "\[%{HTTPDATE:timestamp}\] %{IPORHOST:client_ip} %{NOTSPACE:tls_version} %{NOTSPACE:crypto_algorithm} \"(?:%{WORD:method} %{NOTSPACE:request}(?: HTTP/%{NUMBER:httpversion})?|%{DATA:rawrequest})\" %{NUMBER:response}"
				}
		}	
	} else if "logaudit" in [tags] {
		grok{
			patterns_dir => [ "/logs/patterns" ]
			break_on_match => false
			match => {
				"path" => "%{GREEDYDATA}/%{GREEDYDATA:Hostname}-%{YEAR:ColYear}%{MONTHNUM:ColMonth}%{MONTHDAY:ColDay}-%{HOUR:ColHour}%{MINUTE:ColMinute}/%{GREEDYDATA}"	
				}
			add_field => [ "CollectionDateTime", "%{ColYear}-%{ColMonth}-%{ColDay} %{ColHour}:%{ColMinute}" ]
			match => {
					"message" => "type=%{DATA:audit_type}\smsg=audit\(%{NUMBER:audit_epoch}:%{NUMBER:audit_counter}\):.*?( msg=\'(?<sub_msg>.*?)\')?$"
				}
		}	
	} else if "netstat-an" in [tags] {
		grok{
			break_on_match => false
			match => {
				"path" => "%{GREEDYDATA}/%{GREEDYDATA:Hostname}-%{YEAR:ColYear}%{MONTHNUM:ColMonth}%{MONTHDAY:ColDay}-%{HOUR:ColHour}%{MINUTE:ColMinute}/%{GREEDYDATA}"	
				}
			add_field => [ "CollectionDateTime", "%{ColYear}-%{ColMonth}-%{ColDay} %{ColHour}:%{ColMinute}" ]
			match => {
					"message" => "%{WORD:Protocol}%{SPACE}%{NUMBER:RefCnt}%{SPACE}\[%{SPACE}%{GREEDYDATA:Flags}%{SPACE}\]%{SPACE}%{WORD:Type}%{SPACE}%{GREEDYDATA:State}%{SPACE}%{NUMBER:inode}%{SPACE}%{GREEDYDATA:Path}"
				}

		}
	} else if "netstat-antup" in [tags] {
		grok{
			break_on_match => false
			match => {
				"path" => "%{GREEDYDATA}/%{GREEDYDATA:Hostname}-%{YEAR:ColYear}%{MONTHNUM:ColMonth}%{MONTHDAY:ColDay}-%{HOUR:ColHour}%{MINUTE:ColMinute}/%{GREEDYDATA}"	
				}
			add_field => [ "CollectionDateTime", "%{ColYear}-%{ColMonth}-%{ColDay} %{ColHour}:%{ColMinute}" ]
			match => {
					"message" => "%{WORD:Protocol}%{SPACE}%{NUMBER:Recv_Q}%{SPACE}%{NUMBER:Send_Q}%{SPACE}%{NOTSPACE:Local_Address}:%{NUMBER:Local_Port}%{SPACE}%{NOTSPACE:Remote_Address}:%{NOTSPACE:Remote_Port}%{SPACE}%{WORD:State}%{SPACE}%{NUMBER:Pid}/%{GREEDYDATA:Program_Name}"
				}

		}
	} else if "netstat-pvWanoee" in [tags] {
		grok{
			break_on_match => false
			match => {
				"path" => "%{GREEDYDATA}/%{GREEDYDATA:Hostname}-%{YEAR:ColYear}%{MONTHNUM:ColMonth}%{MONTHDAY:ColDay}-%{HOUR:ColHour}%{MINUTE:ColMinute}/%{GREEDYDATA}"	
				}
			add_field => [ "CollectionDateTime", "%{ColYear}-%{ColMonth}-%{ColDay} %{ColHour}:%{ColMinute}" ]
			match => {
					"message" => "%{WORD:Protocol}%{SPACE}%{NUMBER:Recv_Q}%{SPACE}%{NUMBER:Send_Q}%{SPACE}%{NOTSPACE:Local_Address}:%{NUMBER:Local_Port}%{SPACE}%{NOTSPACE:Remote_Address}:%{NOTSPACE:Remote_Port}%{SPACE}%{WORD:State}%{SPACE}%{WORD:User}%{SPACE}%{WORD:Inode}%{SPACE}%{NUMBER:Pid}/%{GREEDYDATA:Program_Name}%{WORD:Timer} %{GREEDYDATA:Timer_Values}"
				}
			match => {
				"message" => "%{WORD:Protocol}%{SPACE}%{NUMBER:RefCnt}%{SPACE}\[%{SPACE}%{GREEDYDATA:Flags}%{SPACE}\]%{SPACE}%{WORD:Type}%{SPACE}%{GREEDYDATA:State}%{SPACE}%{NUMBER:inode}%{SPACE}%{NUMBER:Pid}/%{GREEDYDATA:Program_Name}  %{GREEDYDATA:Path}"
			}

		}
	} else if "last-btmp" in [tags] {
		grok{
			break_on_match => false
			match => {
				"path" => "%{GREEDYDATA}/%{GREEDYDATA:Hostname}-%{YEAR:ColYear}%{MONTHNUM:ColMonth}%{MONTHDAY:ColDay}-%{HOUR:ColHour}%{MINUTE:ColMinute}/%{GREEDYDATA}"	
				}
			add_field => [ "CollectionDateTime", "%{ColYear}-%{ColMonth}-%{ColDay} %{ColHour}:%{ColMinute}" ]
			match => {
					"message" => "(?<User>(?:^|(?:[.!?]\s))(\w+))%{SPACE}(?<Session>([a-z]*:[a-z]*[^ ]))%{SPACE}%{WORD:SessionDay}%{SPACE}%{WORD:SessionMonth}%{SPACE}%{WORD:SessionDayNo}%{SPACE}(?<Time>\d\d:\d\d:\d\d)%{SPACE}%{WORD:SessionYear}%{SPACE}(?<State>(.*)- ([^ ].* ))%{IPV4}"
				}
			add_field => [ "SessionDateTime", "%{SessionDayNo}-%{SessionMonth}-%{SessionYear} %{Time}" ]

		}
	} else if "lastlog" in [tags] {
		grok{
			break_on_match => false
			match => {
				"path" => "%{GREEDYDATA}/%{GREEDYDATA:Hostname}-%{YEAR:ColYear}%{MONTHNUM:ColMonth}%{MONTHDAY:ColDay}-%{HOUR:ColHour}%{MINUTE:ColMinute}/%{GREEDYDATA}"	
				}
			add_field => [ "CollectionDateTime", "%{ColYear}-%{ColMonth}-%{ColDay} %{ColHour}:%{ColMinute}" ]
			match => {
					"message" => "%{WORD:Username}%{SPACE}(?<Port>([^ ]+))%{SPACE}%{IP:From}%{SPACE}%{GREEDYDATA:Latest}"
				}
			match => {
					"message" => "(?<Username>^[^ ]+)%{SPACE}(?<Port>([^ ]+))%{SPACE}(?<Latest>([A-Z].*[0-9]{4}))"
				}
			match => {
				"message" => "(?<Username>^[^ ]+)%{SPACE}(?<Latest>\*\*.*)"
			}

		}
	} else if "last-wtmp" in [tags] {
		grok{
			break_on_match => false
			match => {
				"path" => "%{GREEDYDATA}/%{GREEDYDATA:Hostname}-%{YEAR:ColYear}%{MONTHNUM:ColMonth}%{MONTHDAY:ColDay}-%{HOUR:ColHour}%{MINUTE:ColMinute}/%{GREEDYDATA}"	
				}
			add_field => [ "CollectionDateTime", "%{ColYear}-%{ColMonth}-%{ColDay} %{ColHour}:%{ColMinute}" ]
			match => {
					"message" => "(?<User>(?:^|(?:[.!?]\s))(\w+))%{SPACE}(?<Terminal>([^ ]+))%{SPACE}%{DAY:SessionStartDay}%{SPACE}%{MONTH:SessionStartMonth}%{SPACE}%{MONTHDAY:SessionStartDayNo}%{SPACE}%{TIME:SessionStartTime}%{SPACE}%{YEAR:SessionStartYear}%{SPACE}(?<SessionState>[a-zA-Z ]*)%{IPV4:From}"
				}
			match => {
					"message" => "(?<User>(?:^|(?:[.!?]\s))(\w+))%{SPACE}(?<Terminal>([^ ]+))%{SPACE}%{DAY:SessionStartDay}%{SPACE}%{MONTH:SessionStartMonth}%{SPACE}%{MONTHDAY:SessionStartDayNo}%{SPACE}%{TIME:SessionStartTime}%{SPACE}%{YEAR:SessionStartYear}%{SPACE}(?<Dash>\-)%{SPACE}%{DAY:SessionEndDay}%{SPACE}%{MONTH:SessionEndMonth}%{SPACE}%{MONTHDAY:SessionEndDayNo}%{SPACE}%{TIME:SessionEndTime}%{SPACE}%{YEAR:SessionEndYear}%{SPACE}(?<SessionDuration>\(\d\d:\d\d\))%{SPACE}%{IPV4:From}"
				}
			match => {
					"message" => "(?<User>(?:^|(?:[.!?]\s))(\w+))%{SPACE}(?<Terminal>\(.*\))%{SPACE}%{DAY:SessionStartDay}%{SPACE}%{MONTH:SessionStartMonth}%{SPACE}%{MONTHDAY:SessionStartDayNo}%{SPACE}%{TIME:SessionStartTime}%{SPACE}%{YEAR:SessionStartYear}%{SPACE}(?<Dash>\-)%{SPACE}%{DAY:SessionEndDay}%{SPACE}%{MONTH:SessionEndMonth}%{SPACE}%{MONTHDAY:SessionEndDayNo}%{SPACE}%{TIME:SessionEndTime}%{SPACE}%{YEAR:SessionEndYear}%{SPACE}(?<SessionDuration>\(\d\d:\d\d\))%{SPACE}%{IPV4:From}"
				}
			match => {
					"message" => "(?<User>(?:^|(?:[.!?]\s))(\w+))%{SPACE}(?<Terminal>system (?:down|boot))%{SPACE}%{DAY:SessionStartDay}%{SPACE}%{MONTH:SessionStartMonth}%{SPACE}%{MONTHDAY:SessionStartDayNo}%{SPACE}%{TIME:SessionStartTime}%{SPACE}%{YEAR:SessionStartYear}%{SPACE}(?<Dash>\-)%{SPACE}%{DAY:SessionEndDay}%{SPACE}%{MONTH:SessionEndMonth}%{SPACE}%{MONTHDAY:SessionEndDayNo}%{SPACE}%{TIME:SessionEndTime}%{SPACE}%{YEAR:SessionEndYear}%{SPACE}(?<SessionDuration>\(\d\d:\d\d\))%{SPACE}%{IPV4:From}"
				}

		}
	} else if "persistencesystemdlist" in [tags] {
		grok{
			break_on_match => false
			match => {
				"path" => "%{GREEDYDATA}/%{GREEDYDATA:Hostname}-%{YEAR:ColYear}%{MONTHNUM:ColMonth}%{MONTHDAY:ColDay}-%{HOUR:ColHour}%{MINUTE:ColMinute}/%{GREEDYDATA}"	
				}
			add_field => [ "CollectionDateTime", "%{ColYear}-%{ColMonth}-%{ColDay} %{ColHour}:%{ColMinute}" ]
			match => {
					"message" => "%{GREEDYDATA:message}"
				}

		}
	} else if "potwebshell1000" in [tags] {
	  grok {
		  break_on_match => false
		  match => {
			  "path" => "%{GREEDYDATA}/%{GREEDYDATA:Hostname}-%{YEAR:ColYear}%{MONTHNUM:ColMonth}%{MONTHDAY:ColDay}-%{HOUR:ColHour}%{MINUTE:ColMinute}/%{GREEDYDATA}"	
			  }
		  add_field => [ "CollectionDateTime", "%{ColYear}-%{ColMonth}-%{ColDay} %{ColHour}:%{ColMinute}" ]		  
		  match =>  {
			"message" => "==>%{SPACE}%{GREEDYDATA:FullPath} <==%{GREEDYDATA:First100line}" 
		  }
	  }
  } else if "potwebshellhashes" in [tags] {
		grok{
			break_on_match => false
			match => {
				"path" => "%{GREEDYDATA}/%{GREEDYDATA:Hostname}-%{YEAR:ColYear}%{MONTHNUM:ColMonth}%{MONTHDAY:ColDay}-%{HOUR:ColHour}%{MINUTE:ColMinute}/%{GREEDYDATA}"	
				}
			add_field => [ "CollectionDateTime", "%{ColYear}-%{ColMonth}-%{ColDay} %{ColHour}:%{ColMinute}" ]
			match => {
					"message" => "%{NOTSPACE:MD5}%{SPACE}%{GREEDYDATA:FullPath}"
				}

		}
	} else 	if "bash_aliases" in [tags] {
		grok{
			break_on_match => false
			match => {
				"path" => "%{GREEDYDATA}/%{GREEDYDATA:Hostname}-%{YEAR:ColYear}%{MONTHNUM:ColMonth}%{MONTHDAY:ColDay}-%{HOUR:ColHour}%{MINUTE:ColMinute}/%{GREEDYDATA}/%{GREEDYDATA:User}/bash_aliases"	
				}
			add_field => [ "CollectionDateTime", "%{ColYear}-%{ColMonth}-%{ColDay} %{ColHour}:%{ColMinute}" ]
			match => {
					"message" => "(?<bash_aliases_line>^[^#]+)"
				}

		}
	} else if "bashhistory" in [tags] {
		grok{
			break_on_match => false
			match => {
				"path" => "%{GREEDYDATA}/%{GREEDYDATA:Hostname}-%{YEAR:ColYear}%{MONTHNUM:ColMonth}%{MONTHDAY:ColDay}-%{HOUR:ColHour}%{MINUTE:ColMinute}/%{GREEDYDATA}/%{GREEDYDATA:User}/bash_history"	
				}
			add_field => [ "CollectionDateTime", "%{ColYear}-%{ColMonth}-%{ColDay} %{ColHour}:%{ColMinute}" ]
			match => {
					"message" => "%{GREEDYDATA:cmdline}"
				}

		}
	} else if "bash_logout" in [tags] {
		grok{
			break_on_match => false
			match => {
				"path" => "%{GREEDYDATA}/%{GREEDYDATA:Hostname}-%{YEAR:ColYear}%{MONTHNUM:ColMonth}%{MONTHDAY:ColDay}-%{HOUR:ColHour}%{MINUTE:ColMinute}/%{GREEDYDATA}/%{GREEDYDATA:User}/bash_logout"	
				}
			add_field => [ "CollectionDateTime", "%{ColYear}-%{ColMonth}-%{ColDay} %{ColHour}:%{ColMinute}" ]
			match => {
					"message" => "(?<bash_logout_line>^[^#]+)"
				}

		}
	} else if "bashprofile" in [tags] {
		grok{
			break_on_match => false
			match => {
				"path" => "%{GREEDYDATA}/%{GREEDYDATA:Hostname}-%{YEAR:ColYear}%{MONTHNUM:ColMonth}%{MONTHDAY:ColDay}-%{HOUR:ColHour}%{MINUTE:ColMinute}/%{GREEDYDATA}/%{GREEDYDATA:User}/profile"	
				}
			add_field => [ "CollectionDateTime", "%{ColYear}-%{ColMonth}-%{ColDay} %{ColHour}:%{ColMinute}" ]
			match => {
					"message" => "(?<bash_profile_line>^[^#]+)"
				}

		}
	} else if "bashrc" in [tags] {
		grok{
			break_on_match => false
			match => {
				"path" => "%{GREEDYDATA}/%{GREEDYDATA:Hostname}-%{YEAR:ColYear}%{MONTHNUM:ColMonth}%{MONTHDAY:ColDay}-%{HOUR:ColHour}%{MINUTE:ColMinute}/%{GREEDYDATA}/%{GREEDYDATA:User}/bash_rc"	
				}
			add_field => [ "CollectionDateTime", "%{ColYear}-%{ColMonth}-%{ColDay} %{ColHour}:%{ColMinute}"	]
			match => {
					"message" => "(?<bashrc_line>^[^#]+)"
				}

		}
	} else if "binhashes" in [tags] {
		grok{
			break_on_match => false
			match => {
				"path" => "%{GREEDYDATA}/%{GREEDYDATA:Hostname}-%{YEAR:ColYear}%{MONTHNUM:ColMonth}%{MONTHDAY:ColDay}-%{HOUR:ColHour}%{MINUTE:ColMinute}/%{GREEDYDATA}"	
				}
			add_field => [ "CollectionDateTime", "%{ColYear}-%{ColMonth}-%{ColDay} %{ColHour}:%{ColMinute}" ]
			match => {
					"message" => "(?<md5sum>.*) %{SPACE}(?<Full Path>.*)"
				}

		}
	} else if "cpuinfo" in [tags] {
		grok {
			break_on_match => false
			match => {
				"path" => "%{GREEDYDATA}/%{GREEDYDATA:Hostname}-%{YEAR:ColYear}%{MONTHNUM:ColMonth}%{MONTHDAY:ColDay}-%{HOUR:ColHour}%{MINUTE:ColMinute}/%{GREEDYDATA}"	
				}
			add_field => [ "CollectionDateTime", "%{ColYear}-%{ColMonth}-%{ColDay} %{ColHour}:%{ColMinute}" ]
		}
		kv {
            source => "message"
            trim_key => "\s"
			field_split => ":"
		}
    } else if "crontablist" in [tags] {
		grok{
			break_on_match => false
			match => {
				"path" => "%{GREEDYDATA}/%{GREEDYDATA:Hostname}-%{YEAR:ColYear}%{MONTHNUM:ColMonth}%{MONTHDAY:ColDay}-%{HOUR:ColHour}%{MINUTE:ColMinute}/%{GREEDYDATA}"	
				}
			add_field => [ "CollectionDateTime", "%{ColYear}-%{ColMonth}-%{ColDay} %{ColHour}:%{ColMinute}" ]
			match => {
					"message" => "%{WORD:User}\n%{GREEDYDATA:CronTab}"
				}

		}
	} else 	if "devdirfiles" in [tags] {
		grok{
			break_on_match => false
			match => {
				"path" => "%{GREEDYDATA}/%{GREEDYDATA:Hostname}-%{YEAR:ColYear}%{MONTHNUM:ColMonth}%{MONTHDAY:ColDay}-%{HOUR:ColHour}%{MINUTE:ColMinute}/%{GREEDYDATA}"	
				}
			add_field => [ "CollectionDateTime", "%{ColYear}-%{ColMonth}-%{ColDay} %{ColHour}:%{ColMinute}" ]
			match => {
					"message" => "%{NOTSPACE:FullPath}\: %{GREEDYDATA:FileType}"
				}

		}
	} else if "devdirfileshashes" in [tags] {
		grok{
			break_on_match => false
			match => {
				"path" => "%{GREEDYDATA}/%{GREEDYDATA:Hostname}-%{YEAR:ColYear}%{MONTHNUM:ColMonth}%{MONTHDAY:ColDay}-%{HOUR:ColHour}%{MINUTE:ColMinute}/%{GREEDYDATA}"	
				}
			add_field => [ "CollectionDateTime", "%{ColYear}-%{ColMonth}-%{ColDay} %{ColHour}:%{ColMinute}" ]
			match => {
					"message" => "%{NOTSPACE:MD5}%{SPACE}%{GREEDYDATA:FullPath}"
				}

		}
	} else if "execpermfiles" in [tags] {
		grok{
			break_on_match => false
			match => {
				"path" => "%{GREEDYDATA}/%{GREEDYDATA:Hostname}-%{YEAR:ColYear}%{MONTHNUM:ColMonth}%{MONTHDAY:ColDay}-%{HOUR:ColHour}%{MINUTE:ColMinute}/%{GREEDYDATA}"	
				}
			add_field => [ "CollectionDateTime", "%{ColYear}-%{ColMonth}-%{ColDay} %{ColHour}:%{ColMinute}" ]
			match => {
					"message" => "%{NOTSPACE:FullPath}\: %{GREEDYDATA:FileType}"
				}

		}
	} else if "fulltimeline" in [tags] {
		grok{
			break_on_match => false
			match => {
				"path" => "%{GREEDYDATA}/%{GREEDYDATA:Hostname}-%{YEAR:ColYear}%{MONTHNUM:ColMonth}%{MONTHDAY:ColDay}-%{HOUR:ColHour}%{MINUTE:ColMinute}/%{GREEDYDATA}"	
				}
			add_field => [ "CollectionDateTime", "%{ColYear}-%{ColMonth}-%{ColDay} %{ColHour}:%{ColMinute}" ]
			match => {
					"message" => "%{NUMBER:Inode},%{NUMBER:HardLinkCount},(?<Full Path>[^,]+),(?<Last Access>[^,]+),(?<Last Modification>[^,]+),(?<Last Status Change>[^,]+),(?<File Creation>[^,]+),%{WORD:User},%{WORD:Group},(?<Permissions>[^,]+),%{NUMBER:FileSizeBytes}"
				}

		}
	} else if "hostdateandtime" in [tags] {
		grok{
			break_on_match => false
			match => {
				"path" => "%{GREEDYDATA}/%{GREEDYDATA:Hostname}-%{YEAR:ColYear}%{MONTHNUM:ColMonth}%{MONTHDAY:ColDay}-%{HOUR:ColHour}%{MINUTE:ColMinute}/%{GREEDYDATA}"	
				}
			add_field => [ "CollectionDateTime", "%{ColYear}-%{ColMonth}-%{ColDay} %{ColHour}:%{ColMinute}" ]
			match => {
					"message" => "%{GREEDYDATA:Details}"
				}

		}
	} else if "ifconfig-a" in [tags] {
		grok{
			break_on_match => false
			match => {
				"path" => "%{GREEDYDATA}/%{GREEDYDATA:Hostname}-%{YEAR:ColYear}%{MONTHNUM:ColMonth}%{MONTHDAY:ColDay}-%{HOUR:ColHour}%{MINUTE:ColMinute}/%{GREEDYDATA}"	
				}
			add_field => [ "CollectionDateTime", "%{ColYear}-%{ColMonth}-%{ColDay} %{ColHour}:%{ColMinute}" ]
			match => {
					"message" => "%{SPACE}inet (?<IPv4>[^ ]+) %{GREEDYDATA:Details}"
				}
			match => {
					"message" => "%{SPACE}inet6 (?<IPv6>[^ ]+) %{GREEDYDATA:Details}"
				}

		}
	} else if "ip_a" in [tags] {
		grok{
			break_on_match => false
			match => {
				"path" => "%{GREEDYDATA}/%{GREEDYDATA:Hostname}-%{YEAR:ColYear}%{MONTHNUM:ColMonth}%{MONTHDAY:ColDay}-%{HOUR:ColHour}%{MINUTE:ColMinute}/%{GREEDYDATA}"	
				}
			add_field => [ "CollectionDateTime", "%{ColYear}-%{ColMonth}-%{ColDay} %{ColHour}:%{ColMinute}" ]
			match => {
					"message" => "%{SPACE}inet (?<IPv4>[^ ]+) %{GREEDYDATA:Details}"
				}
			match => {
					"message" => "%{SPACE}inet6 (?<IPv6>[^ ]+) %{GREEDYDATA:Details}"
				}

		}
	} else if "iptables" in [tags] {
		grok{
			break_on_match => false
			match => {
				"path" => "%{GREEDYDATA}/%{GREEDYDATA:Hostname}-%{YEAR:ColYear}%{MONTHNUM:ColMonth}%{MONTHDAY:ColDay}-%{HOUR:ColHour}%{MINUTE:ColMinute}/%{GREEDYDATA}"	
				}
			add_field => [ "CollectionDateTime", "%{ColYear}-%{ColMonth}-%{ColDay} %{ColHour}:%{ColMinute}" ]
			match => {
					"message" => "%{WORD:Target}%{SPACE}%{WORD:Protocol}%{SPACE}--%{SPACE}%{WORD:Source}%{SPACE}%{WORD:Destination}%{SPACE}%{GREEDYDATA:Comment}"
				}

		}
	} else if "knownhosts" in [tags] {
		grok{
			break_on_match => false
			match => {
				"path" => "%{GREEDYDATA}/%{GREEDYDATA:Hostname}-%{YEAR:ColYear}%{MONTHNUM:ColMonth}%{MONTHDAY:ColDay}-%{HOUR:ColHour}%{MINUTE:ColMinute}/%{GREEDYDATA}/%{GREEDYDATA:User}/.ssh/known_hosts"	
				}
			add_field => [ "CollectionDateTime", "%{ColYear}-%{ColMonth}-%{ColDay} %{ColHour}:%{ColMinute}" ]
			match => {
					"message" => "%{IP:Ip}%{SPACE}%{NOTSPACE:Encryption}%{SPACE}%{GREEDYDATA:Signature}"
				}

		}
	} else if "processhashes" in [tags] {
		grok{
			break_on_match => false
			match => {
				"path" => "%{GREEDYDATA}/%{GREEDYDATA:Hostname}-%{YEAR:ColYear}%{MONTHNUM:ColMonth}%{MONTHDAY:ColDay}-%{HOUR:ColHour}%{MINUTE:ColMinute}/%{GREEDYDATA}"	
				}
			add_field => [ "CollectionDateTime", "%{ColYear}-%{ColMonth}-%{ColDay} %{ColHour}:%{ColMinute}" ]
			match => {
					"message" => "%{NOTSPACE:MD5}%{SPACE}%{GREEDYDATA:Process}"
				}

		}
	} else if "release" in [tags] {
		grok{
			break_on_match => false
			match => {
				"path" => "%{GREEDYDATA}/%{GREEDYDATA:Hostname}-%{YEAR:ColYear}%{MONTHNUM:ColMonth}%{MONTHDAY:ColDay}-%{HOUR:ColHour}%{MINUTE:ColMinute}/%{GREEDYDATA}"	
				}
			add_field => [ "CollectionDateTime", "%{ColYear}-%{ColMonth}-%{ColDay} %{ColHour}:%{ColMinute}" ]
			match => {
					"message" => "%{GREEDYDATA:Details}"
				}

		}
	} else if "routetable" in [tags] {
		grok{
			break_on_match => false
			match => {
				"path" => "%{GREEDYDATA}/%{GREEDYDATA:Hostname}-%{YEAR:ColYear}%{MONTHNUM:ColMonth}%{MONTHDAY:ColDay}-%{HOUR:ColHour}%{MINUTE:ColMinute}/%{GREEDYDATA}"	
				}
			add_field => [ "CollectionDateTime", "%{ColYear}-%{ColMonth}-%{ColDay} %{ColHour}:%{ColMinute}" ]
			match => {
					"message" => "%{GREEDYDATA:Details}"
				}

		}
	} else if "selinux" in [tags] {
		grok{
			break_on_match => false
			match => {
				"path" => "%{GREEDYDATA}/%{GREEDYDATA:Hostname}-%{YEAR:ColYear}%{MONTHNUM:ColMonth}%{MONTHDAY:ColDay}-%{HOUR:ColHour}%{MINUTE:ColMinute}/%{GREEDYDATA}"	
				}
			add_field => [ "CollectionDateTime", "%{ColYear}-%{ColMonth}-%{ColDay} %{ColHour}:%{ColMinute}" ]
			match => {
					"message" => "\:%{SPACE}%{GREEDYDATA:SelinuxStatus}"
				}

		}
	} else if "setuidsetguid" in [tags] {
		grok{
			break_on_match => false
			match => {
				"path" => "%{GREEDYDATA}/%{GREEDYDATA:Hostname}-%{YEAR:ColYear}%{MONTHNUM:ColMonth}%{MONTHDAY:ColDay}-%{HOUR:ColHour}%{MINUTE:ColMinute}/%{GREEDYDATA}"	
				}
			add_field => [ "CollectionDateTime", "%{ColYear}-%{ColMonth}-%{ColDay} %{ColHour}:%{ColMinute}" ]
			match => {
					"message" => "%{GREEDYDATA:FullPath}"
				}

		}
	} else if "ss-anepo" in [tags] {
		grok{
			break_on_match => false
			match => {
				"path" => "%{GREEDYDATA}/%{GREEDYDATA:Hostname}-%{YEAR:ColYear}%{MONTHNUM:ColMonth}%{MONTHDAY:ColDay}-%{HOUR:ColHour}%{MINUTE:ColMinute}/%{GREEDYDATA}"	
				}
			add_field => [ "CollectionDateTime", "%{ColYear}-%{ColMonth}-%{ColDay} %{ColHour}:%{ColMinute}" ]
			match => {
					"message" => "%{WORD:NetID}%{SPACE}%{WORD:State}%{SPACE}%{NUMBER:RecvQ}%{SPACE}%{NUMBER:SendQ}%{SPACE}%{GREEDYDATA:Local_Address} %{NUMBER:Local_Port}%{SPACE}%{GREEDYDATA:Peer_Address} %{NUMBER:Peer_Port}%{SPACE}users:\(\(\"%{WORD:User}\",pid=%{NUMBER:Pid},fd=%{NUMBER:fd}%{GREEDYDATA}"
				}
			match => {
					"message" => "%{WORD:NetID}%{SPACE}%{WORD:State}%{SPACE}%{NUMBER:RecvQ}%{SPACE}%{NUMBER:SendQ}%{SPACE}%{GREEDYDATA:Local_Address}:%{NUMBER:Local_Port}%{SPACE}%{GREEDYDATA:Peer_Address}:%{NOTSPACE:Peer_Port}%{SPACE}users:\(\(\"%{WORD:User}\",pid=%{NUMBER:Pid},fd=%{NUMBER:fd}\)\) ino:%{NUMBER:ino} sk:%{GREEDYDATA:sk} <->"
			}
			match => {
					"message" => "%{WORD:NetID}%{SPACE}%{WORD:State}%{SPACE}%{NUMBER:RecvQ}%{SPACE}%{NUMBER:SendQ}%{SPACE}%{GREEDYDATA:Local_Address}:%{NUMBER:Local_Port}%{SPACE}%{GREEDYDATA:Peer_Address}:%{NOTSPACE:Peer_Port}%{SPACE}users:%{GREEDYDATA:Users}"
			}

		}
	} else if "systemctlall" in [tags] {
		grok{
			break_on_match => false
			match => {
				"path" => "%{GREEDYDATA}/%{GREEDYDATA:Hostname}-%{YEAR:ColYear}%{MONTHNUM:ColMonth}%{MONTHDAY:ColDay}-%{HOUR:ColHour}%{MINUTE:ColMinute}/%{GREEDYDATA}"	
				}
			add_field => [ "CollectionDateTime", "%{ColYear}-%{ColMonth}-%{ColDay} %{ColHour}:%{ColMinute}" ]
			match => {
					"message" => "(?<Unit>[a-z][^ ]+)%{SPACE}%{WORD:State}"
				}

		}
	} else if "systemctlstatus" in [tags] {
		grok{
			break_on_match => false
			match => {
				"path" => "%{GREEDYDATA}/%{GREEDYDATA:Hostname}-%{YEAR:ColYear}%{MONTHNUM:ColMonth}%{MONTHDAY:ColDay}-%{HOUR:ColHour}%{MINUTE:ColMinute}/%{GREEDYDATA}"	
				}
			add_field => [ "CollectionDateTime", "%{ColYear}-%{ColMonth}-%{ColDay} %{ColHour}:%{ColMinute}" ]
			match => {
					"message" => "(?<Unit>[a-z][^ ]+)%{SPACE}(?<Load>[^ ]+)%{SPACE}(?<Active>[^ ]+)%{SPACE}(?<Sub>[^ ]+)%{SPACE}%{GREEDYDATA:Description}"
				}

		}
	} else if "viminfo" in [tags] {
		grok{
			break_on_match => false
			match => {
				"path" => "%{GREEDYDATA}/%{GREEDYDATA:Hostname}-%{YEAR:ColYear}%{MONTHNUM:ColMonth}%{MONTHDAY:ColDay}-%{HOUR:ColHour}%{MINUTE:ColMinute}/%{GREEDYDATA}"	
				}
			add_field => [ "CollectionDateTime", "%{ColYear}-%{ColMonth}-%{ColDay} %{ColHour}:%{ColMinute}" ]
			match => {
					"message" => "%{GREEDYDATA:Entry}"
				}

		}
	} else if "whoandwhat" in [tags] {
		grok{
			break_on_match => false
			match => {
				"path" => "%{GREEDYDATA}/%{GREEDYDATA:Hostname}-%{YEAR:ColYear}%{MONTHNUM:ColMonth}%{MONTHDAY:ColDay}-%{HOUR:ColHour}%{MINUTE:ColMinute}/%{GREEDYDATA}"	
				}
			add_field => [ "CollectionDateTime", "%{ColYear}-%{ColMonth}-%{ColDay} %{ColHour}:%{ColMinute}" ]
			match => {
					"message" => "(?<User>(?:^|(?:[.!?]\s))(\w+))%{SPACE}(?<Session>[^ ]+)%{SPACE}(?<From>[^ ]+)%{SPACE}(?<LoginAt>\d\d:\d\d)%{SPACE}(?<IDLE>[^ ]+)%{SPACE}(?<JCPU>[^ ]+)%{SPACE}(?<PCPU>[^ ]+)%{GREEDYDATA:What}"
				}

		}
	} else if "authorized_keys" in [tags] {
		grok{
			break_on_match => false
			match => {
				"path" => "%{GREEDYDATA}/%{GREEDYDATA:Hostname}-%{YEAR:ColYear}%{MONTHNUM:ColMonth}%{MONTHDAY:ColDay}-%{HOUR:ColHour}%{MINUTE:ColMinute}/%{GREEDYDATA}/%{GREEDYDATA:User}/.ssh/authorized_keys"	
				}
			add_field => [ "CollectionDateTime", "%{ColYear}-%{ColMonth}-%{ColDay} %{ColHour}:%{ColMinute}" ]
			match => {
					"message" => "(?<Protocol>[^ ]+)%{SPACE}%{NOTSPACE}%{SPACE}%{GREEDYDATA:Credentials}"
				}

		}
	} else if "processexelinks" in [tags] {
		grok{
			break_on_match => false
			match => {
				"path" => "%{GREEDYDATA}/%{GREEDYDATA:Hostname}-%{YEAR:ColYear}%{MONTHNUM:ColMonth}%{MONTHDAY:ColDay}-%{HOUR:ColHour}%{MINUTE:ColMinute}/%{GREEDYDATA}"	
				}
			add_field => [ "CollectionDateTime", "%{ColYear}-%{ColMonth}-%{ColDay} %{ColHour}:%{ColMinute}" ]
			match => {
					"message" => "%{NOTSPACE:Permissions}%{SPACE}%{NUMBER:Hardlinks}%{SPACE}%{WORD:User}%{SPACE}%{WORD:Group}%{SPACE}%{NUMBER:SizeByte}%{SPACE}%{MONTH:LastModificationMonth}%{SPACE}%{SPACE}%{MONTHDAY:LastModificationDay}%{SPACE}(?<LastModificationTime>\d\d:\d\d)%{SPACE}%{GREEDYDATA:FullPath} -> %{GREEDYDATA:Link}"
				}

		}
	} else if "processfilelinks" in [tags] {
		grok{
			break_on_match => false
			match => {
				"path" => "%{GREEDYDATA}/%{GREEDYDATA:Hostname}-%{YEAR:ColYear}%{MONTHNUM:ColMonth}%{MONTHDAY:ColDay}-%{HOUR:ColHour}%{MINUTE:ColMinute}/%{GREEDYDATA}"	
				}
			add_field => [ "CollectionDateTime", "%{ColYear}-%{ColMonth}-%{ColDay} %{ColHour}:%{ColMinute}" ]
			match => {
					"message" => "%{NOTSPACE:Permissions}%{SPACE}%{NUMBER:Hardlinks}%{SPACE}%{WORD:User}%{SPACE}%{WORD:Group}%{SPACE}%{NUMBER:SizeByte}%{SPACE}%{MONTH:LastModificationMonth}%{SPACE}%{SPACE}%{MONTHDAY:LastModificationDay}%{SPACE}(?<LastModificationTime>\d\d:\d\d)%{SPACE}%{GREEDYDATA:FullPath} -> %{GREEDYDATA:Link}"
				}
		}
	} else if "processes-axwwso" in [tags] {
		grok {
			break_on_match => false
			match => {
				"path" => "%{GREEDYDATA}/%{GREEDYDATA:Hostname}-%{YEAR:ColYear}%{MONTHNUM:ColMonth}%{MONTHDAY:ColDay}-%{HOUR:ColHour}%{MINUTE:ColMinute}/%{GREEDYDATA}"	
				}
			add_field => [ "CollectionDateTime", "%{ColYear}-%{ColMonth}-%{ColDay} %{ColHour}:%{ColMinute}" ]
			match => {
				"message" => "%{WORD:User}%{SPACE}%{WORD:Pid}%{SPACE}%{WORD:PPid}%{SPACE}%{WORD:VSZ}%{SPACE}%{WORD:RSS}%{SPACE}(?<TTY>([a-z]*\/[0-9]|\?))%{SPACE}(?<STAT>([^ ]+))%{SPACE}(?<STIME>[^ ]+)%{SPACE}(?<TIME>\d\d:\d\d:\d\d)%{SPACE}%{GREEDYDATA:Command}"
			}
		}
	} else if "processes-e" in [tags] {
		grok {
			break_on_match => false
			match => {
				"path" => "%{GREEDYDATA}/%{GREEDYDATA:Hostname}-%{YEAR:ColYear}%{MONTHNUM:ColMonth}%{MONTHDAY:ColDay}-%{HOUR:ColHour}%{MINUTE:ColMinute}/%{GREEDYDATA}"	
				}
			add_field => [ "CollectionDateTime", "%{ColYear}-%{ColMonth}-%{ColDay} %{ColHour}:%{ColMinute}" ]
			match => {
				"message" => "%{NUMBER:Pid}%{SPACE}%{NOTSPACE:TTY}%{SPACE}%{NOTSPACE:Time}%{SPACE}%{GREEDYDATA:Commandline}"
			}
		}
	} else if "processes-ecapf" in [tags] {
		grok {
			break_on_match => false
			match => {
				"path" => "%{GREEDYDATA}/%{GREEDYDATA:Hostname}-%{YEAR:ColYear}%{MONTHNUM:ColMonth}%{MONTHDAY:ColDay}-%{HOUR:ColHour}%{MINUTE:ColMinute}/%{GREEDYDATA}"	
				}
			add_field => [ "CollectionDateTime", "%{ColYear}-%{ColMonth}-%{ColDay} %{ColHour}:%{ColMinute}" ]
			match => {
				"message" => "%{WORD:User}%{SPACE}%{NUMBER:Pid}%{SPACE}%{NUMBER:PPid}%{SPACE}%{NUMBER:C}%{SPACE}%{NUMBER:SZ}%{SPACE}%{NUMBER:RSS}%{SPACE}%{NUMBER:PSR}%{NOTSPACE:STIME}%{SPACE}%{NOTSPACE:TTY}%{SPACE}%{NOTSPACE:Time}%{SPACE}%{GREEDYDATA:Command}"
			}
		}
	} else if "processes-ef" in [tags] {
		grok {
			break_on_match => false
			match => {
				"path" => "%{GREEDYDATA}/%{GREEDYDATA:Hostname}-%{YEAR:ColYear}%{MONTHNUM:ColMonth}%{MONTHDAY:ColDay}-%{HOUR:ColHour}%{MINUTE:ColMinute}/%{GREEDYDATA}"	
				}
			add_field => [ "CollectionDateTime", "%{ColYear}-%{ColMonth}-%{ColDay} %{ColHour}:%{ColMinute}" ]
			match => {
				"message" => "%{WORD:User}%{SPACE}%{NUMBER:Pid}%{SPACE}%{NUMBER:PPid}%{SPACE}%{NUMBER:C}%{SPACE}%{NOTSPACE:STIME}%{SPACE}%{NOTSPACE:TTY}%{SPACE}%{NOTSPACE:TIME}%{SPACE}%{GREEDYDATA:Command}"
			}
		}
	} else if "processes-auxsww" in [tags] {
		grok {
			break_on_match => false
			match => {
				"path" => "%{GREEDYDATA}/%{GREEDYDATA:Hostname}-%{YEAR:ColYear}%{MONTHNUM:ColMonth}%{MONTHDAY:ColDay}-%{HOUR:ColHour}%{MINUTE:ColMinute}/%{GREEDYDATA}"	
				}
			add_field => [ "CollectionDateTime", "%{ColYear}-%{ColMonth}-%{ColDay} %{ColHour}:%{ColMinute}" ]
			match => {
				"message" => "%{WORD:User}%{SPACE}%{WORD:Pid}%{SPACE}%{NUMBER:CPU_percent}%{SPACE}%{NUMBER:Mem_percent}%{SPACE}%{WORD:VSZ}%{SPACE}%{WORD:RSS}%{SPACE}(?<TTY>([^ ]+))%{SPACE}(?<STAT>([^ ]+))%{SPACE}%{NOTSPACE:Start}%{SPACE}%{NOTSPACE:Time}%{SPACE}%{GREEDYDATA:Command}"
			}
		}
	} else if "processes-auxww" in [tags] {
		grok {
			break_on_match => false
			match => {
				"path" => "%{GREEDYDATA}/%{GREEDYDATA:Hostname}-%{YEAR:ColYear}%{MONTHNUM:ColMonth}%{MONTHDAY:ColDay}-%{HOUR:ColHour}%{MINUTE:ColMinute}/%{GREEDYDATA}"	
				}
			add_field => [ "CollectionDateTime", "%{ColYear}-%{ColMonth}-%{ColDay} %{ColHour}:%{ColMinute}" ]
			match => {
				"message" => "%{WORD:User}%{SPACE}%{WORD:Pid}%{SPACE}%{NUMBER:CPU_percent}%{SPACE}%{NUMBER:Mem_percent}%{SPACE}%{WORD:VSZ}%{SPACE}%{WORD:RSS}%{SPACE}(?<TTY>([^ ]+))%{SPACE}(?<STAT>([^ ]+))%{SPACE}%{NOTSPACE:Start}%{SPACE}%{NOTSPACE:Time}%{SPACE}%{GREEDYDATA:Command}"
			}
		}
	}
}

output {

	if "logcron" in [tags] {
		elasticsearch {
			hosts => "localhost:9200"
			index => "linux-logcron"
			manage_template => "false"

		}
	} else if "logsecure" in [tags] {
		elasticsearch {
			hosts => "localhost:9200"
			index => "linux-logsecure"
			manage_template => "false"
		}
	} else if "logmessages" in [tags] {
		elasticsearch {
			hosts => "localhost:9200"
			index => "linux-logmessages"
			manage_template => "false"
		}
	} else if "logyum" in [tags] {
		elasticsearch {
			hosts => "localhost:9200"
			index => "linux-logyum"
			manage_template => "false"
		}
	} else if "loghttpdaccess" in [tags] {
		elasticsearch {
			hosts => "localhost:9200"
			index => "linux-loghttpdaccess"
			manage_template => "false"
		}
	} else if "loghttpderror" in [tags] {
		elasticsearch {
			hosts => "localhost:9200"
			index => "linux-loghttpderror"
			manage_template => "false"
		}
	} else if "loghttpdssl_access" in [tags] {
			elasticsearch {
			hosts => "localhost:9200"
			index => "linux-loghttpdssl_access"
			manage_template => "false"
		}
	} else if "ssl_error_log" in [tags] {
			elasticsearch {
			hosts => "localhost:9200"
			index => "linux-ssl_error_log"
			manage_template => "false"
		}
	} else if "loghttpdssl_request" in [tags] {
			elasticsearch {
			hosts => "localhost:9200"
			index => "linux-loghttpdssl_request"
			manage_template => "false"
		}
	} else if "logaudit" in [tags] {
			elasticsearch {
			hosts => "localhost:9200"
			index => "linux-logaudit"
			manage_template => "false"
		}
	} else if "netstat-an" in [tags] {
		elasticsearch {
			hosts => "localhost:9200"
			index => "linux-netstat-an"
			manage_template => "false"

		}
	} else if "netstat-antup" in [tags] {
		elasticsearch {
			hosts => "localhost:9200"
			index => "linux-netstat-antup"
			manage_template => "false"

		}
	} else if "netstat-pvWanoee" in [tags] {
		elasticsearch {
			hosts => "localhost:9200"
			index => "linux-netstat-pvWanoee"
			manage_template => "false"

		}
	} else if "last-btmp" in [tags] {
		elasticsearch {
			hosts => "localhost:9200"
			index => "linux-last-btmp"
			manage_template => "false"

		}
	} else if "lastlog" in [tags] {
		elasticsearch {
			hosts => "localhost:9200"
			index => "linux-lastlog"
			manage_template => "false"
		}
	} else if "last-wtmp" in [tags] {
		elasticsearch {
			hosts => "localhost:9200"
			index => "linux-last-wtmp"
			manage_template => "false"

		}
	} else if "persistencesystemdlist" in [tags] {
		elasticsearch {
			hosts => "localhost:9200"
			index => "linux-persistencesystemdlist"
			manage_template => "false"

		}
	} else if "potwebshell1000" in [tags] {
		elasticsearch {
			hosts => "localhost:9200"
			index => "linux-potwebshell1000"
			manage_template => "false"

		}
	} else if "potwebshellhashes" in [tags] {
		elasticsearch {
			hosts => "localhost:9200"
			index => "linux-potwebshellhashes"
			manage_template => "false"

		}
	} else if "bash_aliases" in [tags] {
		elasticsearch {
			hosts => "localhost:9200"
			index => "linux-bash_aliases"
			manage_template => "false"

		}
	} else if "bashhistory" in [tags] {
		elasticsearch {
			hosts => "localhost:9200"
			index => "linux-bashhistory"
			manage_template => "false"

		}
	} else if "bash_logout" in [tags] {
		elasticsearch {
			hosts => "localhost:9200"
			index => "linux-bash_logout"
			manage_template => "false"

		}
	} else if "bashprofile" in [tags] {
		elasticsearch {
			hosts => "localhost:9200"
			index => "linux-bashprofile"
			manage_template => "false"

		}
	} else if "bashrc" in [tags] {
		elasticsearch {
			hosts => "localhost:9200"
			index => "linux-bashrc"
			manage_template => "false"

		}
	} else if "binhashes" in [tags] {
		elasticsearch {
			hosts => "localhost:9200"
			index => "linux-binhashes"
			manage_template => "false"
		}
	} else if "cpuinfo" in [tags] {
		elasticsearch {
			hosts => "localhost:9200"
			index => "linux-cpuinfo"
			manage_template => "false"

		}
	} else if "crontablist" in [tags] {
		elasticsearch {
			hosts => "localhost:9200"
			index => "linux-crontablist"
			manage_template => "false"

		}
	} else if "devdirfiles" in [tags] {
		elasticsearch {
			hosts => "localhost:9200"
			index => "linux-devdirfiles"
			manage_template => "false"

		}
	} else if "devdirfileshashes" in [tags] {
		elasticsearch {
			hosts => "localhost:9200"
			index => "linux-devdirfileshashes"
			manage_template => "false"

		}
	} else if "execpermfiles" in [tags] {
		elasticsearch {
			hosts => "localhost:9200"
			index => "linux-execpermfiles"
			manage_template => "false"

		}
	} else if "fulltimeline" in [tags] {
		elasticsearch {
			hosts => "localhost:9200"
			index => "linux-fulltimeline"
			manage_template => "false"

		}
	} else if "hostdateandtime" in [tags] {
		elasticsearch {
			hosts => "localhost:9200"
			index => "linux-hostdateandtime"
			manage_template => "false"

		}
	} else if "ifconfig-a" in [tags] {
		elasticsearch {
			hosts => "localhost:9200"
			index => "linux-ifconfig-a"
			manage_template => "false"

		}
	} else if "ip_a" in [tags] {
		elasticsearch {
			hosts => "localhost:9200"
			index => "linux-ip_a"
			manage_template => "false"

		}
	} else if "iptables" in [tags] {
		elasticsearch {
			hosts => "localhost:9200"
			index => "linux-iptables"
			manage_template => "false"

		}
	} else if "knownhosts" in [tags] {
		elasticsearch {
			hosts => "localhost:9200"
			index => "linux-knownhosts"
			manage_template => "false"

		}
	} else if "processhashes" in [tags] {
		elasticsearch {
			hosts => "localhost:9200"
			index => "linux-processhashes"
			manage_template => "false"

		}
	} else if "release" in [tags] {
		elasticsearch {
			hosts => "localhost:9200"
			index => "linux-release"
			manage_template => "false"

		}
	} else if "routetable" in [tags] {
		elasticsearch {
			hosts => "localhost:9200"
			index => "linux-routetable"
			manage_template => "false"

		}
	} else if "selinux" in [tags] {
		elasticsearch {
			hosts => "localhost:9200"
			index => "linux-selinux"
			manage_template => "false"

		}
	} else if "setuidsetguid" in [tags] {
		elasticsearch {
			hosts => "localhost:9200"
			index => "linux-setuidsetguid"
			manage_template => "false"

		}
	} else if "ss-anepo" in [tags] {
		elasticsearch {
			hosts => "localhost:9200"
			index => "linux-ss-anepo"
			manage_template => "false"

		}
	} else 	if "systemctlall" in [tags] {
		elasticsearch {
			hosts => "localhost:9200"
			index => "linux-systemctlall"
			manage_template => "false"

		}
	} else if "systemctlstatus" in [tags] {
		elasticsearch {
			hosts => "localhost:9200"
			index => "linux-systemctlstatus"
			manage_template => "false"

		}
	} else if "viminfo" in [tags] {
		elasticsearch {
			hosts => "localhost:9200"
			index => "linux-viminfo"
			manage_template => "false"

		}
	} else if "whoandwhat" in [tags] {
		elasticsearch {
			hosts => "localhost:9200"
			index => "linux-whoandwhat"
			manage_template => "false"

		}
	} else if "authorized_keys" in [tags] {
		elasticsearch {
			hosts => "localhost:9200"
			index => "linux-authorized_keys"
			manage_template => "false"

		}
	} else if "processexelinks" in [tags] {
		elasticsearch {
			hosts => "localhost:9200"
			index => "linux-processexelinks"
			manage_template => "false"

		}
	} else if "processfilelinks" in [tags] {
		elasticsearch {
			hosts => "localhost:9200"
			index => "linux-processfilelinks"
			manage_template => "false"

		}
	} else if "processes-axwwso" in [tags] {
		elasticsearch {
			hosts => "localhost:9200"
			index => "linux-processes-axwwso"
			manage_template => "false"
		}
	} else if "processes-e" in [tags] {
		elasticsearch {
			hosts => "localhost:9200"
			index => "linux-processes-e"
			manage_template => "false"
		}
	} else if "processes-ecapf" in [tags] {
		elasticsearch {
			hosts => "localhost:9200"
			index => "linux-processes-ecapf"
			manage_template => "false"
		}
	} else if "processes-ef" in [tags] {
		elasticsearch {
			hosts => "localhost:9200"
			index => "linux-processes-ef"
			manage_template => "false"
		}
	} else if "processes-auxsww" in [tags] {
		elasticsearch {
			hosts => "localhost:9200"
			index => "linux-processes-auxsww"
			manage_template => "false"
		}
	} else if "processes-auxww" in [tags] {
		elasticsearch {
			hosts => "localhost:9200"
			index => "linux-processes-auxww"
			manage_template => "false"
		}
	} 
		
	stdout { codec => rubydebug }

}