BUYTIME

IT2/elk stack (13)

[Logstash] 설정 파일

카테고리 : IT2/elk stack buytime | 2023. 2. 6. 23:30

[root@logstash-001 logstash]# cat /etc/logstash/jvm.options ## JVM configuration # Xms represents the initial size of total heap space # Xmx represents the maximum size of total heap space -Xms16g -Xmx16g ################################################################ ## Expert settings ################################################################ ## ## All settings below this section are co..

[Logstash] 신도리코 복합기 ms-sql db 연동

카테고리 : IT2/elk stack buytime | 2023. 2. 5. 22:43

[INPUT] input { jdbc { jdbc_validate_connection => true jdbc_driver_library => "/appdata/logstash/jdbc_driver_library/mssql-jdbc-10.2.0.jre11.jar" jdbc_driver_class => "com.microsoft.sqlserver.jdbc.SQLServerDriver" jdbc_connection_string => "jdbc:sqlserver://10.25.1.150:1433;databasename=SINDOH;encrypt=false;" jdbc_user => "viewer_user" jdbc_password => "P@ssw0rd" jdbc_default_timezone => "Asia/..

[Logstash] ionenet 망연계 mysql db 연동

카테고리 : IT2/elk stack buytime | 2023. 2. 5. 16:36

[INPUT] input { jdbc { jdbc_validate_connection => true jdbc_driver_library => "/appdata/logstash/jdbc_driver_library/mysql-connector-java-8.0.16.jar" jdbc_driver_class => "com.mysql.cj.jdbc.Driver" jdbc_connection_string => "jdbc:mysql://10.25.1.200:3535/onenet?useUnicode=true&serverTimezone=Asia/Seoul" jdbc_user => "viewer_user" jdbc_password => "P@ssw0rd" jdbc_default_timezone => "Asia/Seoul"..

[Logstash] secuve tos mariadb 연동

카테고리 : IT2/elk stack buytime | 2023. 2. 4. 11:32

# tos_master: 마스터 뷰 [INTPUT] input { jdbc { jdbc_validate_connection => true jdbc_driver_library => "/appdata/logstash/jdbc_driver_library/mariadb-java-client-2.7.4.jar" jdbc_driver_class => "org.mariadb.jdbc.Driver" jdbc_connection_string => "jdbc:mariadb://10.103.240.63:3306/tosms8" jdbc_user => "TOSMS8" jdbc_password => "TOSMS8" jdbc_default_timezone => "Asia/Seoul" schedule => "40 1 * * *" s..

[Logstash] wapple syslog 연동

카테고리 : IT2/elk stack buytime | 2023. 2. 3. 23:02

[INPUT] input { syslog { port => 9400 } } [FILTER] filter { dissect { mapping => { "message" => "[WAPPLES}: 10 %{[log][type]} 10 %{msg}" } } mutate { gsub => ["msg"," 10 "," & "] gsub => ["msg"," \[ ",":["] } date { match => ["timestamp","MMM dd HH:mm:ss","MMM d HH:mm:ss"] timezone => "Asia/Seoul" locale => "en" target => "timestamp" } if [log][type] == "AUDIT" { dissect { mapping => { "msg" => ..

[Logstash] MFI IPS syslog 연동

카테고리 : IT2/elk stack buytime | 2023. 2. 2. 07:58

[INTPUT] input { syslog { port => 9406 grok_pattern => "%{GREEDYDATA:message}" } } [FILTER] filter { mutate { remove_field => ["facility", "priority", "severity"] gsub => ["message","\u0000",""] } dissect { mapping => { "message" => "1 %{syslogtime} [%{[event][type]}] [%{send_ip}] %{mesg}" } } if [event][type] == "raw" { mutate { split => ["mesg",","] add_field => { "starttime" => "%{[mesg][0]}"..

[Logstash] MF2 방화벽 syslog 연동

카테고리 : IT2/elk stack buytime | 2023. 2. 2. 01:11

[INPUT] input { syslog { port => 9401 grok_pattern => "%{GREEDYDATA:message}" } } [FILTER] filter { mutate { gsub => ["message","\n",""] remove_field => ["severity","priority"] } dissect { mapping => { "message" => "1 %{syslogtime} [%{[event][type]}] [%{from_ip}]%{msg}" } } if [event][type] == "audit" { mutate { split => ["msg",","] add_field => { "time" => "%{[msg][0]}" "machine_name" => "%{[ms..

[Logstash] NAC syslog 연동

카테고리 : IT2/elk stack buytime | 2023. 2. 1. 20:11

# NAC 5.0 버전 [INPUT] input { udp { port => 5514 } } [FILTER] filter { grok { match => { "message" => "\%{TIMESTAMP_ISO8601:_datetime} %{LOGLEVEL:_logtype} %{INT:_logid} %{DATA:_sensorname} %{DATA:_ip} %{DATA:_mac} %{DATA:detailmsg} %{GREEDYDATA:_fullmsg}" } } mutate { gsub => ["_fullmsg"," NONE",". "] gsub => ["_fullmsg","NONE ",""] } mutate { split => ["_fullmsg",". "] add_field => { "_fullmsg_..

[Logstash] AXGATE 방화벽 DB syslog 연동

카테고리 : IT2/elk stack buytime | 2023. 1. 27. 19:36

[INPUT] input { syslog { port => 9407 // 포트는 임의로 지정 grok_pattern => "%{GREEDYDATA:message}" } } [Filter] filter { dissect { mapping => { "message" => "%{created.month} %{created.date} %{created.time} %{[machine][name]} %{[event][category]}: ver:%{version},%{msg}" } } mutate { gsub => ["message","\n",""] } date { match => ["time","yyyy-MM-dd HH:mm:ss","MMM d HH:mm:ss"] timezone => "Asia/Seoul" lo..

[Logstash] Oracle DB ORA-12514, TNS:listener does not currently know of service 문제

카테고리 : IT2/elk stack buytime | 2022. 10. 28. 19:28

상황 : Logstash - Oracle DB 연동 과정 에러 : JDBC Connection Error 원인 : JDBC 문자열 URL 지정 방법이 2가지가 있는데, 올바르게 사용하지 못해서 발생 * JDBC 문자열 URL을 지정할 수 있는 두 가지 방법 1) jdbc:oracle:thin:@[호스트][:포트]:SID 또는 2) jdbc:oracle:thin:@//[호스트][:포트]/서비스네임 해결 : 1) 방법을 이용하여 해결

Copyright © BUYTIME :: 시간을 산다 All Rights Reserved

Designed by JB FACTORY

티스토리툴바