logstash_bro.conf

input {
  stdin {
  }

# Production Logs#############################
  bro {
    type => "app_stats"
    path => "/logfile_path/app_stats.log"
    start_position => "beginning"
    sincedb_path => "/dev/null"
  }
  bro {
    type => "conn"
    path => "/logfile_path/conn.log"
    start_position => "beginning"
    sincedb_path => "/dev/null"
  }
  bro {
    type => "dns_entropy"
    path => "/logfile_path/dns_entropy.log"
    start_position => "beginning"
    sincedb_path => "/dev/null"
  }
  bro {
    type => "dhcp"
    path => "/logfile_path/dhcp.log"
    start_position => "beginning"
    sincedb_path => "/dev/null"
  }
  bro {
    type => "dns"
    path => "/logfile_path/dns.log"
    start_position => "beginning"
    sincedb_path => "/dev/null"
  }
  bro {
    type => "dpd"
    path => "/logfile_path/dpd.log"
    start_position => "beginning"
    sincedb_path => "/dev/null"
  }
  bro {
    type => "files"
    path => "/logfile_path/files.log"
    start_position => "beginning"
    sincedb_path => "/dev/null"
  }
  bro {
    type => "http"
    path => "/logfile_path/http.log"
    start_position => "beginning"
    sincedb_path => "/dev/null"
  }
  bro {
    type => "http_entropy"
    path => "/logfile_path/http_entropy.log"
    start_position => "beginning"
    sincedb_path => "/dev/null"
  }
  bro {
    type => "kerberos"
    path => "/logfile_path/kerberos.log"
    start_position => "beginning"
    sincedb_path => "/dev/null"
  }
  bro {
    type => "known_certs"
    path => "/logfile_path/known_certs.log"
    start_position => "beginning"
    sincedb_path => "/dev/null"
  }
  bro {
    type => "known_hosts"
    path => "/logfile_path/known_hosts.log"
    start_position => "beginning"
    sincedb_path => "/dev/null"
  }
  bro {
    type => "known_services"
    path => "/logfile_path/known_services.log"
    start_position => "beginning"
    sincedb_path => "/dev/null"
  }  
  bro {
    type => "intel"
    path => "/logfile_path/intel.log"
    start_position => "beginning"
    sincedb_path => "/dev/null"
  }
  bro {
    type => "notice"
    path => "/logfile_path/notice.log"
    start_position => "beginning"
    sincedb_path => "/dev/null"
  }
  bro {
    type => "pe"
    path => "/logfile_path/pe.log"
    start_position => "beginning"
    sincedb_path => "/dev/null"
  }
  bro {
    type => "rdp"
    path => "/logfile_path/rdp.log"
    start_position => "beginning"
    sincedb_path => "/dev/null"
  }
  bro {
    type => "sip"
    path => "/logfile_path/sip.log"
    start_position => "beginning"
    sincedb_path => "/dev/null"
  }
  bro {
    type => "smtp"
    path => "/logfile_path/smtp.log"
    start_position => "beginning"
    sincedb_path => "/dev/null"
  }
  bro {
    type => "socks"
    path => "/logfile_path/socks.log"
    start_position => "beginning"
    sincedb_path => "/dev/null"
  }
  bro {
    type => "software"
    path => "/logfile_path/software.log"
    start_position => "beginning"
    sincedb_path => "/dev/null"
  }
  bro {
    type => "ssh"
    path => "/logfile_path/ssh.log"
    start_position => "beginning"
    sincedb_path => "/dev/null"
  }
  bro {
    type => "ssl"
    path => "/logfile_path/ssl.log"
    start_position => "beginning"
    sincedb_path => "/dev/null"
  }
  bro {
    type => "syslog"
    path => "/logfile_path/syslog.log"
    start_position => "beginning"
    sincedb_path => "/dev/null"
  }
  bro {
    type => "traceroute"
    path => "/logfile_path/traceroute.log"
    start_position => "beginning"
    sincedb_path => "/dev/null"
  }
  bro {
    type => "weird"
    path => "/logfile_path/weird.log"
    start_position => "beginning"
    sincedb_path => "/dev/null"
  }
  bro {
    type => "x509"
    path => "/logfile_path/x509.log"
    start_position => "beginning"
    sincedb_path => "/dev/null"
  }
}

# Benchmark!
filter {
    metrics {
        meter => "benchmark"
        add_tag => "metric"
    }
}

output {
    if "metric" in [tags] {
        stdout {
            codec => line {
                format => "%{[benchmark][rate_1m]} requests/sec, ( %{[benchmark][count]} total)"
            }
        }
    }

#  stdout { codec => rubydebug }
  elasticsearch {
    hosts => ["127.0.0.1:9200"]
  }
}