{"id":1977,"date":"2021-09-18T19:12:25","date_gmt":"2021-09-18T17:12:25","guid":{"rendered":"https:\/\/blog.mhasin.eu\/?p=1977"},"modified":"2021-09-19T08:54:02","modified_gmt":"2021-09-19T06:54:02","slug":"bind9-elk-send-log","status":"publish","type":"post","link":"https:\/\/blog.mhasin.eu\/?p=1977","title":{"rendered":"BIND9 ELK send LOG"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Blokova schema<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"121\" height=\"661\" src=\"https:\/\/blog.mhasin.eu\/wp-content\/uploads\/2021\/09\/obrazok.png\" alt=\"\" class=\"wp-image-1979\" srcset=\"https:\/\/blog.mhasin.eu\/wp-content\/uploads\/2021\/09\/obrazok.png 121w, https:\/\/blog.mhasin.eu\/wp-content\/uploads\/2021\/09\/obrazok-55x300.png 55w\" sizes=\"auto, (max-width: 121px) 100vw, 121px\" \/><figcaption>Schema ELK<\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Nastavenie BIND9 Logovania:<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>logging{\n        category \"notify\" { \"log_notify\"; };\n        category \"xfer-in\" { \"log_notify\"; };\n        category \"xfer-out\" { \"log_notify\"; };\n        channel \"log_notify\" {\n                file \"\/var\/log\/named\/named.notify.log\" versions 7 size 50m;\n                severity debug 1;\n                print-time yes;\n                print-severity yes;\n                print-category yes;\n        };\n\n        category \"security\" { \"log_security\"; };\n        channel \"log_security\" {\n                file \"\/var\/log\/named\/named.security.log\" versions 7 size 50m;\n                severity debug 1;\n                print-time yes;\n                print-severity yes;\n                print-category yes;\n        };\n\n        category \"default\" { \"log_default\"; };\n        channel \"log_default\" {\n                file \"\/var\/log\/named\/named.default.log\" versions 7 size 50m;\n                severity debug 1;\n                print-time yes;\n                print-severity yes;\n                print-category yes;\n        };\n        category \"queries\" { \"log_default\"; };\n        channel \"log_default\" {\n                file \"\/var\/log\/named\/named.queries.log\" versions 7 size 350m;\n#                severity debug 1;\n                print-time yes;\n                print-severity yes;\n                print-category yes;\n        };\n\n    channel security_file {\n        file \"\/var\/log\/named\/security.log\" versions 3 size 30m;\n        severity dynamic;\n        print-time yes;\n    };\n    category security {\n        security_file;\n    };\n\n\n};\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Nastavenie FileBeat:<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>processors:\n#  - add_host_metadata: ~\n#  - add_cloud_metadata: ~\n\noutput.logstash:\n  # The Logstash hosts\n  hosts: &#91;\"192.168.207.13:5001\"]\n\n\n\nfilebeat.inputs:\n    - input_type: log\n      paths:\n        - \"\/var\/log\/named\/named.queries.log\"\n\n      fields:\n   \n        log_type: bind\n\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Nastavenie Logstash:<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>filter {\n    if &#91;fields]&#91;log_type] == \"bind\" {\n\n          grok {\n                patterns_dir => &#91;\"\/etc\/logstash\/patern\"]\n                match => { \"message\" => \"%{BIND9_DATE:EventTime} queries: %{LOGLEVEL:LogLevel}: client %{DATA:ClientID} %{IP:ClientIP}&#91;#]%{NUMBER:ClientPort} \\(%{HOSTNAME:Hostname}\\)&#91;:] query: %{HOSTNAME:QueryName} %{WORD:QueryClass} %{WORD:QueryType} %{DATA:QueryFlags} \\(%{IP:LocalAddress}\\)\" }\n\n              }\n          date {\n                match => &#91; \"EventTime\", \"dd-MMM-yyyy HH:mm:ss.SSS\"]\n                timezone => \"Europe\/Bratislava\"\n            }\n          mutate {\n                    remove_field => &#91;\"path\", \"host\", \"@version\", \"EventTime\" ]\n            }\n\n    }\n\n\n    if &#91;fields]&#91;log_type] == \"bindold\" {\n\n          grok {\n                patterns_dir => &#91;\"\/etc\/logstash\/patern\"]\n                match => { \"message\" => \"%{BIND9_DATE:EventTime} queries: %{LOGLEVEL:LogLevel}: client %{IP:ClientIP}&#91;#]%{NUMBER:ClientPort} \\(%{HOSTNAME:Hostname}\\)&#91;:] query: %{HOSTNAME:QueryName} %{WORD:QueryClass} %{WORD:QueryType} %{DATA:QueryFlags} \\(%{IP:LocalAddress}\\)\" }\n\n              }\n          date {\n                match => &#91; \"EventTime\", \"dd-MMM-yyyy HH:mm:ss.SSS\"]\n                timezone => \"Europe\/Bratislava\"\n            }\n          mutate {\n                    remove_field => &#91;\"path\", \"host\", \"@version\", \"EventTime\" ]\n            }\n\n    }\n\n\n\n}\n\n\n\n\noutput {\n        if \"_grokparsefailure\" not in &#91;tags] {\n        # do something\n\n                if &#91;fields]&#91;log_type] == \"bind\" {\n                            elasticsearch {\n                                hosts => &#91;\"147.232.207.2:9200\"]\n                                index => \"dns-%{+YYYY.MM.dd}\"\n\n\n                            }\n                }\n        }\n\n        if \"_grokparsefailure\" not in &#91;tags] {\n        # do something\n\n                if &#91;fields]&#91;log_type] == \"bindold\" {\n                            elasticsearch {\n                                hosts => &#91;\"147.232.207.2:9200\"]\n                                index => \"dns-%{+YYYY.MM.dd}\"\n\n\n                            }\n                }\n        }\n\n        if \"_grokparsefailure\" in &#91;tags] {\n                if &#91;fields]&#91;log_type] == \"bind\" {\n                            elasticsearch {\n                                hosts => &#91;\"147.232.207.2:9200\"]\n                                index => \"grokparsefailure-dns-%{+YYYY.MM.dd}\"\n\n\n                            }\n                }\n        }\n\n\n}\n\n\n\n\n\n\n\n\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">patern:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>BIND9_DATE %{MONTHDAY}&#91;-]%{MONTH}&#91;-]%{YEAR}&#91; ]*%{TIME}\n<\/code><\/pre>\n<div class=\"pdf24Plugin-cp\"> \t<form name=\"pdf24Form0\" method=\"post\" action=\"https:\/\/doc2pdf.pdf24.org\/wordpress.php\" target=\"pdf24PopWin\" onsubmit=\"var pdf24Win = window.open('about:blank', 'pdf24PopWin', 'resizable=yes,scrollbars=yes,width=600,height=250,left='+(screen.width\/2-300)+',top='+(screen.height\/3-125)+''); pdf24Win.focus(); if(typeof pdf24OnCreatePDF === 'function'){void(pdf24OnCreatePDF(this,pdf24Win));}\"> \t\t<input type=\"hidden\" name=\"blogCharset\" value=\"Cw1x07UAAA==\" \/><input type=\"hidden\" name=\"blogPosts\" value=\"MwQA\" \/><input type=\"hidden\" name=\"blogUrl\" value=\"yygpKSi20tdPyslP18vNSCzOzNNLLQUA\" \/><input type=\"hidden\" name=\"blogName\" value=\"c\/LxdwcA\" \/><input type=\"hidden\" name=\"blogValueEncoding\" value=\"gzdeflate base64\" \/><input type=\"hidden\" name=\"postId_0\" value=\"M7Q0NwcA\" \/><input type=\"hidden\" name=\"postTitle_0\" value=\"c\/L0c7FUcPXxVihOzUtR8PF3BwA=\" \/><input type=\"hidden\" name=\"postLink_0\" value=\"yygpKSi20tdPyslP18vNSCzOzNNLLdW3L7A1tDQ3BwA=\" \/><input type=\"hidden\" name=\"postAuthor_0\" value=\"y00syfcwNAIA\" \/><input type=\"hidden\" name=\"postDateTime_0\" value=\"MzIwMtQ1sNQ1tFAwtLQysLQyMgUA\" \/><input type=\"hidden\" name=\"postContent_0\" value=\"7VdRU+M2EH73r9CIoXPXYjsJBRqTZApHrjBNgELaDjOXyQhbsTXYlmvJgZBxf3tXsp0ESOhBr9Pezekhzq53tZ++XWllo5UgNyRCtPFtYl6H3L0xE5ISPyVJgDuHIb\/hE4KEG9CItOykY8BojZmfpfSJI4uIT5Fg99QcZ2GIOy0W+SjkxGOx38YhuZ9i5FGXFzIR09jF6JZ5MmjjeqOOUUCZH8g23t0FQaRuGwdSJsKxbYjgW1FABIstmtkQ0+WxpLG0s0RFEHaj1qjbtabNr1Nyz2+sJPYxIiHMhpeQaoxmvbnX1AEElf8wBgLgt1vo1XOYOzt327Wanmpn5xZr\/gArySTfQm8icmdqhhwVKLl7i+q12gQCagkju6Oy4ZJEMh53LnWeULf3c8teUmsBMlZk79mMt4RMeex3TomQZEJjRtHhyelRE\/W4D5UQM+K07NJmXg\/JimKALFOYTj06wIkPKZ8ZqBwukdTn6RThmEs2hrKYIQxWo1LcR\/n+CuO7MU1NFr\/EmmfyefOAxDENHxigBdBqjFlIEbYnJLXB0I5JRL3i1yqcLFBjNKGpAMIF2tNpRDu1aP\/JXIKCGZNT2ArXGdTPU4skZbE0JYsomlKx7v18nmds5mw8sIH1r+BLUDdT8835mivWM7bk8xLOKrcvgDWPjkkWLoqsktdztvB4CWWl1+fG2FPC\/shgNir+dcLKOKsJ29aMbfx\/i6wioNopI73SBQErF75mW22Xa14uksVKp+DL3MWbVSssMzOHXAVaAvQA6NzLMOCnZesuAO3itS3oPcx5SIl8Re9JUu5SIXgqHJVvExHPGwVcyFFEJfGIJA76c\/HGDXnmPXhlQAtJMr3xAI8IHFjbBhoEVLVErUFqOgFq\/XTQNxvN+j6uNxtWffcHq1Hbs+rbzk6tVsdDBVkRdA2LsVgM8wpHc2UiLY3kNKEO3Jn8ktiEyKA0Kcz+vtirU2rMaOgVvnN\/tZ2KENcs9oxPkJqKhFekBoiQNC1riI0L3grUQ\/2\/QjtE7TbCCrE6A5b2k5\/ymxWnApAGE8di5LEUtTtlQmwqXbvKog02YAIZeewcEekGygvOpwgqB+6LWIl4c6ZvQqOjg0HX6cLq5QA2SY5K7h20Oeud\/dTr\/tbtOcBKD3ZYmDvAAANTeAl+B847LZ0c5aA4Oa\/E81xD3Bhuzk5\/7R92L8oX5zyVOfrwZnN2fHY5OD3od51jqDGV8\/zDW+3jDDWAqQo\/N\/pFaU6VFWh\/P7s4KjTvVDIeqgZAb16B05r3IfFFERQA9rhLwgPPS4EJCIlRbjxiLF+SYc\/QFfmYU6oRIzwnD29BA\/XMfr9vTmGg42MnihwhrMvLyxWpUYfSPY+pTkc3S3lC7cOUSCZCMiHYWAcryuRqYGqkNOITOtJ1tygWte8UOrWl1fPH8jRV\/xfw0fBRTKN8vKCkefhZV\/XXIv5yi9jQP2UDXIoMhY1HqkqhNQi4nLEQPi4xgi8h6GJFbAn8D5dcNpDHkeDQWAP4EjSeLOLjj3\/0zKBQG5LBVz1JIVfP26qhG\/aCr\/r3e1Zju6FbdsNpNmq1Ffl7gjz26J1OphcLc3P23RUMq9+3PC\/HhvGsf26s1yzV6H\/Gd3k2faW8onwd3V9SGT9etfnJSS7PFX1JfNkFtOhvzkdfMRe9DdpD\/+x0cHx0cFX0KXNYahbiVffgopDQ8NvN2eCk380fIfwL\" \/> \t\t<a href=\"https:\/\/www.pdf24.org\" target=\"_blank\" title=\"www.pdf24.org\" rel=\"nofollow\"><img src=\"https:\/\/blog.mhasin.eu\/wp-content\/plugins\/pdf24-post-to-pdf\/img\/pdf_32x32.png\" alt=\"\" border=\"0\" height=\"32\" \/><\/a> \t\t<span class=\"pdf24Plugin-cp-space\">&nbsp;&nbsp;<\/span> \t\t<span class=\"pdf24Plugin-cp-text\">Send article as PDF<\/span> \t\t<span class=\"pdf24Plugin-cp-space\">&nbsp;&nbsp;<\/span> \t\t<input class=\"pdf24Plugin-cp-input\" style=\"margin: 0px;\" type=\"text\" name=\"sendEmailTo\" placeholder=\"Enter email address\" \/> \t\t<input class=\"pdf24Plugin-cp-submit\" style=\"margin: 0px;\" type=\"submit\" value=\"Send\" \/> \t<\/form> <\/div>","protected":false},"excerpt":{"rendered":"Blokova schema Nastavenie BIND9 Logovania: Nastavenie FileBeat: Nastavenie Logstash: patern: &nbsp;&nbsp; Send article as PDF &nbsp;&nbsp;\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"arc_restricted_post":false,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-1977","post","type-post","status-publish","format-standard","hentry","category-nezaradene"],"_links":{"self":[{"href":"https:\/\/blog.mhasin.eu\/index.php?rest_route=\/wp\/v2\/posts\/1977","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.mhasin.eu\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.mhasin.eu\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.mhasin.eu\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.mhasin.eu\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1977"}],"version-history":[{"count":6,"href":"https:\/\/blog.mhasin.eu\/index.php?rest_route=\/wp\/v2\/posts\/1977\/revisions"}],"predecessor-version":[{"id":1986,"href":"https:\/\/blog.mhasin.eu\/index.php?rest_route=\/wp\/v2\/posts\/1977\/revisions\/1986"}],"wp:attachment":[{"href":"https:\/\/blog.mhasin.eu\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1977"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.mhasin.eu\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1977"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.mhasin.eu\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1977"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}