{"id":1341,"date":"2024-09-05T14:49:37","date_gmt":"2024-09-05T06:49:37","guid":{"rendered":"http:\/\/blue.yn.cn\/?p=1341"},"modified":"2024-09-05T23:33:02","modified_gmt":"2024-09-05T15:33:02","slug":"%e5%8d%8e%e4%b8%89%e9%98%b2%e6%8a%a4%e5%a2%99%e4%bc%9a%e8%af%9d%e8%a1%a8%e4%bf%a1%e6%81%af%e8%bd%ac%e5%ad%98%e5%88%b0elastic","status":"publish","type":"post","link":"http:\/\/blue.yn.cn\/?p=1341","title":{"rendered":"\u534e\u4e09\u9632\u706b\u5899\u4f1a\u8bdd\u8868\u4fe1\u606f\u8f6c\u5b58\u5230elastic"},"content":{"rendered":"<h3>\u534e\u4e09F5000\u9632\u706b\u5899\u914d\u7f6e<\/h3>\n<ul>\n<li>\u65e5\u5fd7\u8bbe\u7f6e--&gt;\u57fa\u672c\u8bbe\u7f6e--&gt;\u7cfb\u7edf\u65e5\u5fd7--&gt;\u65b0\u5efa\u65e5\u5fd7\u4e3b\u673a\uff1a<code>ip<\/code>\u5730\u5740\u4e3a<code>logstash<\/code>\u7684\u5730\u5740\uff0c\u7aef\u53e3\u53f7\u662f514<\/li>\n<li>\u65e5\u5fd7\u8bbe\u7f6e--&gt;\u57fa\u672c\u8bbe\u7f6e--&gt;\u5feb\u901f\u65e5\u5fd7\uff1a\u65e5\u5fd7\u4fe1\u606f\u65f6\u95f4\u6233\u9009\u62e9\u8bbe\u5907\u672c\u5730\u65f6\u95f4<\/li>\n<li>\u65e5\u5fd7\u8bbe\u7f6e--&gt;\u4f1a\u8bdd\u65e5\u5fd7\uff1a\u65e5\u5fd7\u7c7b\u578b\u9009\u62e9\u5feb\u901f\u65e5\u5fd7\u3001\u8bb0\u5f55\u65b0\u5efa\u4f1a\u8bdd\u7684\u65e5\u5fd7\uff1b\u7136\u540e\u6dfb\u52a0\u751f\u6210\u65e5\u5fd7\u7684\u63a5\u53e3\u5217\u8868<\/li>\n<\/ul>\n<h3>Rsyslog\u914d\u7f6e<\/h3>\n<pre><code class=\"language-bash\"># \u76d1\u542cudp 514\u7aef\u53e3\n$ModLoad imudp\n$UDPServerRun 514\n\n# \u914d\u7f6e\u65e5\u5fd7\u5b58\u50a8\u6a21\u7248\n$template FirewallTemplate,&quot;%timereported:::date-rfc3339% %hostname% %fromhost-ip% %msg:::sp-if-no-1st-sp%%msg:::drop-last-lf%\\n&quot;\n\n# \u914d\u7f6e\u5b58\u50a8\u4f4d\u7f6e\n$template Firewall,&quot;\/firewall\/f5000session\/%$NOW%.log&quot;\n\n# \u4f1a\u8bdd\u8868\u4f20\u9001\u65f6\u4e0d\u5e26facility local* \u7b49\u7ea7\uff0c\u6240\u4ee5\u901a\u8fc7IP\u5730\u5740\u5339\u914d\u3002\nif $fromhost-ip == &quot;x.x.x.x&quot; then action(type=&quot;omfile&quot; FileCreateMode=&quot;0755&quot; DirCreateMode=&quot;0755&quot; dynaFile=&quot;Firewall&quot; template=&quot;FirewallTemplate&quot;)<\/code><\/pre>\n<p>\u91cd\u542f\u670d\u52a1\uff1a<br \/>\n<code>systemctl restart rsyslog.service<\/code><\/p>\n<h3>logstash\u914d\u7f6e<\/h3>\n<ol>\n<li><code>input<\/code>\u63d2\u4ef6\u914d\u7f6e\uff1a<\/li>\n<\/ol>\n<pre><code class=\"language-bash\">vim \/etc\/logstash\/conf.d\/network.logstash.conf\ninput {\n  file {\n    path =&gt; [&quot;\/firewall\/f5000session\/*.log&quot;]\n    type =&gt; firewall_session\n    start_position =&gt; &quot;beginning&quot;\n    sincedb_path =&gt; &quot;\/firewall\/f5000session\/incedb&quot;\n  }\n}<\/code><\/pre>\n<ol start=\"2\">\n<li><code>filter<\/code>\u63d2\u4ef6\u914d\u7f6e<\/li>\n<\/ol>\n<pre><code class=\"language-bash\">filter {\nif [type] == &quot;firewall_session&quot;{\n        grok {\n                match =&gt; {\n                &quot;message&quot; =&gt; [\n                # v4\u4f1a\u8bdd\u7684\u5339\u914d\n                &quot;%{TIMESTAMP_ISO8601:date}\\s\\d+\\s[\\s\\S]+IPV%{NUMBER:version}\\S.*Protocol\\(1001\\)=%{URIPROTO:protocol};Application\\(1002\\)=%{USERNAME:app};\\S+SrcIPAddr\\(1003\\)=%{IP:srcip};SrcPort\\(1004\\)=%{USERNAME:srcport};NatSrcIPAddr\\(1005\\)=%{IP:natsrcip};NatSrcPort\\(1006\\)=%{USERNAME:natsrcport};DstIPAddr\\(1007\\)=%{IP:dstip};DstPort\\(1008\\)=%{USERNAME:dstport};NatDstIPAddr\\(1009\\)=%{IP:natdstip};NatDstPort\\(1010\\)=%{USERNAME:natdstport}&quot;,\n                # v6\u4f1a\u8bdd\u7684\u5339\u914d\n                &quot;%{TIMESTAMP_ISO8601:date}\\s\\d+\\s[\\s\\S]+IPV%{NUMBER:version}\\S.*Protocol\\(1001\\)=%{URIPROTO:protocol};Application\\(1002\\)=%{USERNAME:app};\\S+SrcIPv6Addr\\(1036\\)=%{IP:srcip};SrcPort\\(1004\\)=%{USERNAME:srcport};DstIPv6Addr\\(1037\\)=%{IP:dstip};DstPort\\(1008\\)=%{USERNAME:dstport}&quot;\n                        ]\n                }\n        }\n}\n        date {\n                match =&gt; [ &quot;syslog_timestamp&quot;, &quot;MMM  d HH:mm:ss&quot;, &quot;MMM dd HH:mm:ss&quot; ]\n        }\n        mutate {\n                remove_field =&gt; [&quot;message&quot;]\n        }\n        # \u5982\u679c\u76ee\u7684\u5730\u5740\u7b49\u4e8e\u5730\u5740\u8f6c\u6362\u540e\u7684\u76ee\u7684\u5730\u5740\uff0c\u5c31\u662fnat outbound\uff0c\u628anatdstip\u548cnatdstport\u5220\u6389\uff0c\u597d\u540e\u7eed\u5224\u65ad\u4e14\u8282\u7701\u7a7a\u95f4\n        if[dstip] == [natdstip] {\n                mutate {\n                        remove_field =&gt; [ &quot;natdstip&quot;, &quot;natdstport&quot; ]\n                }\n        }\n        # \u5982\u679c\u6e90\u5730\u5740\u5730\u5740\u7b49\u4e8e\u5730\u5740\u8f6c\u6362\u540e\u7684\u6e90\u5730\u5740\uff0c\u5c31\u662fnat server\uff0c\u628anatsrcip\u548cnatsrcport\u5220\u6389\uff0c\u597d\u540e\u7eed\u5224\u65ad\u4e14\u8282\u7701\u7a7a\u95f4\n        if[srcip] == [natsrcip] {\n                mutate {\n                        remove_field =&gt; [ &quot;natsrcip&quot;, &quot;natsrcport&quot; ]\n                }\n        }\nif [version] == &quot;4&quot;{\n        elasticsearch {\n        hosts =&gt; [&quot;x.x.x.x:9200&quot;,&quot;x.x.x.x:9200&quot;,&quot;x.x.x.x:9200&quot;]\n        user =&gt; &quot;elastic&quot;\n        password =&gt; &quot;xxxxxx&quot;\n        query_template =&gt; &quot;search-by-ipv4.json&quot;\n        index =&gt; &quot;ipaddrfordep&quot;\n        fields =&gt; {\n        &quot;department&quot; =&gt; &quot;[department]&quot;\n                }\n        }\n}\nif [version] == &quot;6&quot;{\n        elasticsearch {\n        hosts =&gt; [&quot;x.x.x.x:9200&quot;,&quot;x.x.x.x:9200&quot;,&quot;x.x.x.x:9200&quot;]\n        user =&gt; &quot;elastic&quot;\n        password =&gt; &quot;xxxxxx&quot;\n        query_template =&gt; &quot;search-by-ipv6.json&quot;\n        index =&gt; &quot;ipaddrfordep&quot;\n        fields =&gt; {\n        &quot;department&quot; =&gt; &quot;[department]&quot;\n                }\n        }\n   }\n}<\/code><\/pre>\n<pre><code class=\"language-bash\"># search-by-ipv4.json\u6587\u4ef6\u5185\u5bb9\n{\n  &quot;size&quot;: 1,\n  &quot;query&quot;:{\n    &quot;bool&quot;: {\n      &quot;must&quot;:\n        {\n          &quot;match&quot;: {\n            &quot;range.ipv4range&quot;: &quot;%{[srcip]}&quot;\n          }\n        }\n    }\n  }\n}\n\n# search-by-ipv6.json\u6587\u4ef6\u5185\u5bb9\n{\n  &quot;size&quot;: 1,\n  &quot;query&quot;:{\n    &quot;bool&quot;: {\n      &quot;must&quot;:\n        {\n          &quot;match&quot;: {\n            &quot;range.ipv6range&quot;: &quot;%{[srcip]}&quot;\n          }\n        }\n    }\n  }\n}<\/code><\/pre>\n<p>\u6ce8\u610f\uff1a<code>search-by-ipv4.json\u3001search-by-ipv6.json<\/code>\u5982\u679c\u653e\u5728\u76ee\u5f55<code>\/etc\/logstash\/conf.d<\/code>\u4e0b\uff0c<br \/>\n\u5c31\u8981\u5728\u8be5\u76ee\u5f55\u4e0b\u8f93\u5165\u4ee5\u4e0b\u547d\u4ee4\u8fd0\u884c<code>logstash<\/code><br \/>\n<code> \/usr\/share\/logstash\/bin\/logstash -f \/etc\/logstash\/conf.d\/network.logstash.conf<\/code><\/p>\n<ol start=\"3\">\n<li><code>output<\/code>\u63d2\u4ef6\u914d\u7f6e<\/li>\n<\/ol>\n<pre><code class=\"language-bash\">output {\nif [type] == &quot;firewall_session&quot;{\n    elasticsearch {\n      index =&gt; &quot;networks-firewall-session-%{+YYYY.MM.dd}&quot;\n      hosts =&gt; [&quot;x.x.x.x:9200&quot;,&quot;x.x.x.x:9200&quot;,&quot;x.x.x.x:9200&quot;]\n      user =&gt; &quot;elastic&quot;\n      password =&gt; &quot;xxxxxx&quot;\n    }\n }\n}<\/code><\/pre>\n<h3>elastic\u914d\u7f6e\uff08\u5728kibana\u4e0a\u914d\u7f6e\uff09<\/h3>\n<ol>\n<li>\u914d\u7f6e\u7d22\u5f15\u751f\u547d\u5468\u671f<code>firewall-session-index-policy-02<\/code><\/li>\n<\/ol>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2024\/09\/image-1725542008438.png\" alt=\"file\" \/><\/p>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2024\/09\/image-1725542045606.png\" alt=\"file\" \/><\/p>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2024\/09\/image-1725542060236.png\" alt=\"file\" \/><\/p>\n<ol start=\"2\">\n<li>\u914d\u7f6e\u7d22\u5f15\u6a21\u677f<code>firewall-index-template<\/code>\n<ul>\n<li>\u6620\u5c04\u5982\u4e0b\u914d\u7f6e\uff1a<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2024\/09\/image-1725541815000.png\" alt=\"file\" \/><\/p>\n<ul>\n<li>\u751f\u547d\u5468\u671f\u5982\u4e0b\u914d\u7f6e<\/li>\n<\/ul>\n<pre><code class=\"language-bash\">{\n  &quot;index&quot;: {\n    &quot;lifecycle&quot;: {\n      &quot;name&quot;: &quot;firewall-session-index-policy-02&quot;,\n      &quot;rollover_alias&quot;: &quot;firewall-session&quot;\n    }\n  }\n}<\/code><\/pre>\n<ol start=\"3\">\n<li>\u7d22\u5f15\u7ba1\u7406<br \/>\n\u914d\u7f6e\u597d\u540e\u5728\u7d22\u5f15\u7ba1\u7406\u4e0a\u4f1a\u770b\u5230\u540d\u79f0\u4e3a<code>networks-firewall-session-2024.08.29<\/code>\u7684\u7d22\u5f15<\/li>\n<\/ol>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2024\/09\/image-1725542205069.png\" alt=\"file\" \/><\/p>\n<p>\u7136\u540e\u6dfb\u52a0\u597d<code>networks-firewall-session*<\/code>\u7684\u7d22\u5f15\u6a21\u5f0f<\/p>\n<ol start=\"4\">\n<li><code>discover<\/code>\u83dc\u5355<\/li>\n<\/ol>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2024\/09\/image-1725542489657.png\" alt=\"file\" \/><\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u534e\u4e09F5000\u9632\u706b\u5899\u914d\u7f6e \u65e5\u5fd7\u8bbe\u7f6e&#8211;&gt;\u57fa\u672c\u8bbe\u7f6e&#8211;&gt;\u7cfb\u7edf\u65e5\u5fd7&#8211;&gt;\u65b0\u5efa\u65e5\u5fd7\u4e3b\u673a\uff1aip\u5730\u5740\u4e3a&#8230; &raquo; <a class=\"read-more-link\" href=\"http:\/\/blue.yn.cn\/?p=1341\">\u9605\u8bfb\u5168\u6587<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[18],"tags":[],"class_list":["post-1341","post","type-post","status-publish","format-standard","hentry","category-elk"],"_links":{"self":[{"href":"http:\/\/blue.yn.cn\/index.php?rest_route=\/wp\/v2\/posts\/1341","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/blue.yn.cn\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/blue.yn.cn\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/blue.yn.cn\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/blue.yn.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1341"}],"version-history":[{"count":5,"href":"http:\/\/blue.yn.cn\/index.php?rest_route=\/wp\/v2\/posts\/1341\/revisions"}],"predecessor-version":[{"id":1367,"href":"http:\/\/blue.yn.cn\/index.php?rest_route=\/wp\/v2\/posts\/1341\/revisions\/1367"}],"wp:attachment":[{"href":"http:\/\/blue.yn.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1341"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/blue.yn.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1341"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/blue.yn.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1341"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}