{"id":1977,"date":"2021-09-18T19:12:25","date_gmt":"2021-09-18T17:12:25","guid":{"rendered":"https:\/\/blog.mhasin.eu\/?p=1977"},"modified":"2021-09-19T08:54:02","modified_gmt":"2021-09-19T06:54:02","slug":"bind9-elk-send-log","status":"publish","type":"post","link":"https:\/\/blog.mhasin.eu\/?p=1977","title":{"rendered":"BIND9 ELK send LOG"},"content":{"rendered":"\n<p>Blokova schema<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"121\" height=\"661\" src=\"https:\/\/blog.mhasin.eu\/wp-content\/uploads\/2021\/09\/obrazok.png\" alt=\"\" class=\"wp-image-1979\" srcset=\"https:\/\/blog.mhasin.eu\/wp-content\/uploads\/2021\/09\/obrazok.png 121w, https:\/\/blog.mhasin.eu\/wp-content\/uploads\/2021\/09\/obrazok-55x300.png 55w\" sizes=\"auto, (max-width: 121px) 100vw, 121px\" \/><figcaption>Schema ELK<\/figcaption><\/figure>\n\n\n\n<p><strong>Nastavenie BIND9 Logovania:<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>logging{\n        category \"notify\" { \"log_notify\"; };\n        category \"xfer-in\" { \"log_notify\"; };\n        category \"xfer-out\" { \"log_notify\"; };\n        channel \"log_notify\" {\n                file \"\/var\/log\/named\/named.notify.log\" versions 7 size 50m;\n                severity debug 1;\n                print-time yes;\n                print-severity yes;\n                print-category yes;\n        };\n\n        category \"security\" { \"log_security\"; };\n        channel \"log_security\" {\n                file \"\/var\/log\/named\/named.security.log\" versions 7 size 50m;\n                severity debug 1;\n                print-time yes;\n                print-severity yes;\n                print-category yes;\n        };\n\n        category \"default\" { \"log_default\"; };\n        channel \"log_default\" {\n                file \"\/var\/log\/named\/named.default.log\" versions 7 size 50m;\n                severity debug 1;\n                print-time yes;\n                print-severity yes;\n                print-category yes;\n        };\n        category \"queries\" { \"log_default\"; };\n        channel \"log_default\" {\n                file \"\/var\/log\/named\/named.queries.log\" versions 7 size 350m;\n#                severity debug 1;\n                print-time yes;\n                print-severity yes;\n                print-category yes;\n        };\n\n    channel security_file {\n        file \"\/var\/log\/named\/security.log\" versions 3 size 30m;\n        severity dynamic;\n        print-time yes;\n    };\n    category security {\n        security_file;\n    };\n\n\n};\n<\/code><\/pre>\n\n\n\n<p><strong>Nastavenie FileBeat:<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>processors:\n#  - add_host_metadata: ~\n#  - add_cloud_metadata: ~\n\noutput.logstash:\n  # The Logstash hosts\n  hosts: [\"192.168.207.13:5001\"]\n\n\n\nfilebeat.inputs:\n    - input_type: log\n      paths:\n        - \"\/var\/log\/named\/named.queries.log\"\n\n      fields:\n   \n        log_type: bind\n\n<\/code><\/pre>\n\n\n\n<p><strong>Nastavenie Logstash:<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>filter {\n    if [fields][log_type] == \"bind\" {\n\n          grok {\n                patterns_dir => [\"\/etc\/logstash\/patern\"]\n                match => { \"message\" => \"%{BIND9_DATE:EventTime} queries: %{LOGLEVEL:LogLevel}: client %{DATA:ClientID} %{IP:ClientIP}[#]%{NUMBER:ClientPort} \\(%{HOSTNAME:Hostname}\\)[:] query: %{HOSTNAME:QueryName} %{WORD:QueryClass} %{WORD:QueryType} %{DATA:QueryFlags} \\(%{IP:LocalAddress}\\)\" }\n\n              }\n          date {\n                match => [ \"EventTime\", \"dd-MMM-yyyy HH:mm:ss.SSS\"]\n                timezone => \"Europe\/Bratislava\"\n            }\n          mutate {\n                    remove_field => [\"path\", \"host\", \"@version\", \"EventTime\" ]\n            }\n\n    }\n\n\n    if [fields][log_type] == \"bindold\" {\n\n          grok {\n                patterns_dir => [\"\/etc\/logstash\/patern\"]\n                match => { \"message\" => \"%{BIND9_DATE:EventTime} queries: %{LOGLEVEL:LogLevel}: client %{IP:ClientIP}[#]%{NUMBER:ClientPort} \\(%{HOSTNAME:Hostname}\\)[:] query: %{HOSTNAME:QueryName} %{WORD:QueryClass} %{WORD:QueryType} %{DATA:QueryFlags} \\(%{IP:LocalAddress}\\)\" }\n\n              }\n          date {\n                match => [ \"EventTime\", \"dd-MMM-yyyy HH:mm:ss.SSS\"]\n                timezone => \"Europe\/Bratislava\"\n            }\n          mutate {\n                    remove_field => [\"path\", \"host\", \"@version\", \"EventTime\" ]\n            }\n\n    }\n\n\n\n}\n\n\n\n\noutput {\n        if \"_grokparsefailure\" not in [tags] {\n        # do something\n\n                if [fields][log_type] == \"bind\" {\n                            elasticsearch {\n                                hosts => [\"147.232.207.2:9200\"]\n                                index => \"dns-%{+YYYY.MM.dd}\"\n\n\n                            }\n                }\n        }\n\n        if \"_grokparsefailure\" not in [tags] {\n        # do something\n\n                if [fields][log_type] == \"bindold\" {\n                            elasticsearch {\n                                hosts => [\"147.232.207.2:9200\"]\n                                index => \"dns-%{+YYYY.MM.dd}\"\n\n\n                            }\n                }\n        }\n\n        if \"_grokparsefailure\" in [tags] {\n                if [fields][log_type] == \"bind\" {\n                            elasticsearch {\n                                hosts => [\"147.232.207.2:9200\"]\n                                index => \"grokparsefailure-dns-%{+YYYY.MM.dd}\"\n\n\n                            }\n                }\n        }\n\n\n}\n\n\n\n\n\n\n\n\n<\/code><\/pre>\n\n\n\n<p>patern:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>BIND9_DATE %{MONTHDAY}[-]%{MONTH}[-]%{YEAR}[ ]*%{TIME}\n<\/code><\/pre>\n<div class=\"pdf24Plugin-cp\"> \t<form name=\"pdf24Form0\" method=\"post\" action=\"https:\/\/doc2pdf.pdf24.org\/wordpress.php\" target=\"pdf24PopWin\" onsubmit=\"var pdf24Win = window.open('about:blank', 'pdf24PopWin', 'resizable=yes,scrollbars=yes,width=600,height=250,left='+(screen.width\/2-300)+',top='+(screen.height\/3-125)+''); pdf24Win.focus(); if(typeof pdf24OnCreatePDF === 'function'){void(pdf24OnCreatePDF(this,pdf24Win));}\"> \t\t<input type=\"hidden\" name=\"blogCharset\" value=\"Cw1x07UAAA==\" \/><input type=\"hidden\" name=\"blogPosts\" value=\"MwQA\" \/><input type=\"hidden\" name=\"blogUrl\" value=\"yygpKSi20tdPyslP18vNSCzOzNNLLQUA\" \/><input type=\"hidden\" name=\"blogName\" value=\"c\/LxdwcA\" \/><input type=\"hidden\" name=\"blogValueEncoding\" value=\"gzdeflate base64\" \/><input type=\"hidden\" name=\"postId_0\" value=\"M7Q0NwcA\" \/><input type=\"hidden\" name=\"postTitle_0\" value=\"c\/L0c7FUcPXxVihOzUtR8PF3BwA=\" \/><input type=\"hidden\" name=\"postLink_0\" value=\"yygpKSi20tdPyslP18vNSCzOzNNLLdW3L7A1tDQ3BwA=\" \/><input type=\"hidden\" name=\"postAuthor_0\" value=\"y00syfcwNAIA\" \/><input type=\"hidden\" name=\"postDateTime_0\" value=\"MzIwMtQ1sNQ1tFAwtLQysLQyMgUA\" \/><input type=\"hidden\" name=\"postContent_0\" value=\"7VdRU+M2EH73r9CIoXPXYjsJ5WhMkikcucI0AQppO8xcJiNsxdZgWz5LDoSM+9u7ku0kQELh2k57zOnB9q52tbvfrrSy0Uo6ByG\/5hOChBvQiLTspGPAaI2Zn6UUuSERoo1vEvMq5O61ySLiUyTYHTXHWRjiTotFPgo58Vjst3FI7qYYedTlBU3ENHYxumGeDNq43qhjFFDmB7KN370DQqRuGwdSJsKxbbDgW1FABIstmtlg0+WxpLG0s0RZEHaj1qjbtabNr1Jyx6+tJPYxIiGshpc81T6a9eZuUxsQVP5NGwgcv9lCn72GubNzu12r6aV2dm6wxg98JZnkW+hNRG5NjZCjDCW3b1G9VpuAQU1hZHdUNlySSMbjzoXOE+r2fm7ZS2xNQMaK7CWdlpApj\/3OCRGSTGjMKDo4Pjlsoh73Id0xI07LLmXmSU9WZBxSSSHN6tWBwH3I68xA5XCJpD5PpwjHXLIx5H6GMEiNSnIP5XsrhG\/HNDVZ\/BJpnsmnxQMSxzS8J4AWjlZjzEKKsD0hqQ2Cdkwi6hVPq1CygI3RhKYCUBVoV+cK7dSivUdrCQpiTE6h3q8yKJLHEknKYmlKFlE0pWLd\/HydJ2TmaNyTgfhX4CWom6n15njNGesRW9J5CWaV2itAzaNjkoWLIqvo9ZgtNF4CWan1pSH2GLBPGaxGxb8OWGlnNWDbGrGN\/2+RVQBUO2WkI10AsDLwNdtqu4x5uUgWkU5Bl7mLmVURlpmZu1wZWnLonqNzLcOAR8vWXQDaxZN95gMoHlAiP6PBJCl3qRA8FY5KqomI540CLuQoopJ4RBIH\/bGYcUOeefemDOgTSaZ3F\/gjAgcC2ECDgKq+pzlILSeArd8O+majWd\/D9WbDqr\/7wWrUdq36trNTq9XxULmsULiCYCwWw7rC0YCYSFMjOU2oA7cfv0QvITIoRQqxv67o6igaMxp6he5cX+2ZwsQViz3jufhXkX4G\/hCtpGlZDWxcgFO4NtTflUtD1G4jrNxSu3lpZ\/gpv16xvwEZWDgWI4+lqN0pUbepdO0qVTbIgAjA\/lA5ItINlBacNBGUB1zvsCLx5kzfaUaH+4Ou04Xo5QDKPUclwA7anPVOf+p1f+v2HEClB3slzB1AgIEoTILevvNeU8eHOTCOzyryLNcubgw3Zye\/9g+65+XEGU9ljj6+2ZwdnV4MTvb7XecICkklNv\/4Vus4Q+3AVJmfC\/2iOCdKCri\/n54fFpz3Khn3WQOAN6+c05wPIfFFYRQc7HGXhPuelwISYBKj3HiAWL5Ew8agK\/Ixh1R7jPAcPLwFrdAz+\/2+OYWBjo6cKHKEsC4uLlakRh0vdzymOh3dLOUJtQ9SIpkIyYRgY51bUSZXO6ZGSiM+oSNdd4tiUZtLeaf2rXr\/WJ6L6nvhPho+sGmUrxeUNA+\/6Kr+WsSvt4gN\/Si73JJlKGw8UlWakFTANYuF8C+IEfzTQKsqbEvAf7iksoE8jgSH7hnAP53xKIjnH\/\/oiUGhNiSDn3CSQq6ellVDd+UFXvXvd63GdkP35YbTbNRqK\/L3yPPYo7c6mV4szM3Zd5cwrH7f8rwcG8aT+rmxnrNUo\/8Z3uXZ9BXyCvJ1cL+mMn4YtfmPg1yeK\/qSuOKWWTQx59n3yEUDgx7QPz0ZHB3uXxbNyByWnAV52d0\/Lyg0\/HZzNjjud\/MHbvwJ\" \/> \t\t<a href=\"https:\/\/www.pdf24.org\" target=\"_blank\" title=\"www.pdf24.org\" rel=\"nofollow\"><img src=\"https:\/\/blog.mhasin.eu\/wp-content\/plugins\/pdf24-post-to-pdf\/img\/pdf_32x32.png\" alt=\"\" border=\"0\" height=\"32\" \/><\/a> \t\t<span class=\"pdf24Plugin-cp-space\">\u00a0\u00a0<\/span> \t\t<span class=\"pdf24Plugin-cp-text\">Send article as PDF<\/span> \t\t<span class=\"pdf24Plugin-cp-space\">\u00a0\u00a0<\/span> \t\t<input class=\"pdf24Plugin-cp-input\" style=\"margin: 0px;\" type=\"text\" name=\"sendEmailTo\" placeholder=\"Enter email address\" \/> \t\t<input class=\"pdf24Plugin-cp-submit\" style=\"margin: 0px;\" type=\"submit\" value=\"Send\" \/> \t<\/form> <\/div>","protected":false},"excerpt":{"rendered":"Blokova schema Nastavenie BIND9 Logovania: Nastavenie FileBeat: Nastavenie Logstash: patern: \u00a0\u00a0 Send article as PDF \u00a0\u00a0\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"arc_restricted_post":false,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-1977","post","type-post","status-publish","format-standard","hentry","category-nezaradene"],"_links":{"self":[{"href":"https:\/\/blog.mhasin.eu\/index.php?rest_route=\/wp\/v2\/posts\/1977","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.mhasin.eu\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.mhasin.eu\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.mhasin.eu\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.mhasin.eu\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1977"}],"version-history":[{"count":6,"href":"https:\/\/blog.mhasin.eu\/index.php?rest_route=\/wp\/v2\/posts\/1977\/revisions"}],"predecessor-version":[{"id":1986,"href":"https:\/\/blog.mhasin.eu\/index.php?rest_route=\/wp\/v2\/posts\/1977\/revisions\/1986"}],"wp:attachment":[{"href":"https:\/\/blog.mhasin.eu\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1977"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.mhasin.eu\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1977"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.mhasin.eu\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1977"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}