配置Grafana展示天融信防火墙日志

---

环境要求：

ELK版本要求 7.10+

Grafana 9.1.3

操作系统：CentOS7.9

ELK收集天融信防火墙日志_打攻人的博客-CSDN博客_elk收集防火墙日志

配置Logstash

配置Logstash，格式化天融信日志类型：访问控制、SSLVPN、阻断策略、IPS日志

logstash配置，grok规则还有优化空间：

vim /etc/logstash/conf.d/syslog.conf 

input {
  syslog {
    type => "system-syslog"
    port => 514
    codec => plain {
      charset => "GBK"
    }
  }
}

filter {
  if [message] =~ "192.168.2.10" or [message] =~ "192.168.2.11" {
    drop {}
  }
  # VPN连接日志
  if [message] =~ "sv_netacc" {
  grok {
     match => {
       "message" => "%{TIMESTAMP_ISO8601:timestamp}.*fw=%{DATA:fw}\s*pri=%{INT:pri}\s*type=%{WORD:type2}.*user=%{DATA:user}\s*op=%{DATA:op}\s*src=%{IP:src_ip}\s*sport=%{INT:sport}\s*dst=%{IP:dst_ip}\s*dport=%{INT:dport}\s*sent=%{INT:sent}\s*rcvd=%{INT:rcvd}"
     }
    #remove_field => ["message"]
    }
  }
  # VPN登录日志
  if [message] =~ "sv_system" {
    grok {
       match => {
         "message" => "%{TIMESTAMP_ISO8601:log_time}.*fw=%{DATA:fw}\s*pri=%{INT:pri}.*type=%{WORD:type2}.*op=%{WORD:op}.*ip=%{IP:src_ip}.*user=%{WORD:user}.*dst=%{IP:dst_ip}"
       }
    }
  }
  #访问控制日志
  if [message] =~ "FW-NAT" or [message] =~ "pf" {
    grok {
       match => {
         "message" => "%{TIMESTAMP_ISO8601:log_time}.*fw=%{DATA:fw}\s*pri=%{INT:pri}\s*type=%{WORD:type2}.*src=%{IP:src_ip}\s*dst=%{IP:dst_ip}\s*sport=%{INT:sport}\s*dport=%{INT:dport}.*rule=%{WORD:op}.*policyid=%{INT:policyid}"
       }
    }
  }
  # IPS日志
  if [message] =~ "IPSEVENT" {
    grok {
       match => {
         "message" => "%{TIMESTAMP_ISO8601:log_time}.*fw=%{DATA:fw}\s*pri=%{INT:pri}\s*type=%{WORD:type2}.*src=%{IP:src_ip}\s*sport=%{INT:sport}\s*dst=%{IP:dst_ip}\s*dport=%{INT:dport}\s*rule=%{INT:rule}.*msg=\S{1}%{GREEDYDATA:msg}\S{2}.*application=.*op=\S*\s*%{WORD:op}"
       }
    }
  }
}

output {
  if [type] == "system-syslog" {
    elasticsearch {
      hosts => ["192.168.2.11:9200"]
      user => "elastic"
      password => "sunline"
      index => "syslog-192.168.2.1-%{+YYYY.MM}"
    }
  }
  # 调试使用
  stdout {
    codec => rubydebug
  }
}

关闭logstash

systemctl stop logstash

调试

/usr/share/logstash/bin/logstash --path.settings /etc/logstash/ -f /etc/logstash/conf.d/syslog.conf --config.reload.automatic

没有问题后，按CTRL+C取消

启动logstash

systemctl start logstash

配置Grafana

添加数据源，ElasticSearch version选择7.10+（生产环境7.9.3，选择7.10+没有问题）

配置完成效果如下：