https://github.com/bitsofinfo/fluentd-modsecurity
Fluentd output (filter) plugin for parsing events from ModSecurity audit logs
https://github.com/bitsofinfo/fluentd-modsecurity
Last synced: 3 months ago
JSON representation
Fluentd output (filter) plugin for parsing events from ModSecurity audit logs
- Host: GitHub
- URL: https://github.com/bitsofinfo/fluentd-modsecurity
- Owner: bitsofinfo
- License: apache-2.0
- Created: 2013-11-11T16:24:09.000Z (about 12 years ago)
- Default Branch: master
- Last Pushed: 2018-01-26T20:28:10.000Z (almost 8 years ago)
- Last Synced: 2025-04-13T07:55:57.482Z (10 months ago)
- Language: Ruby
- Homepage: http://bitsofinfo.wordpress.com/2013/11/11/modsecurity-audit-logs-fluentd/
- Size: 14.6 KB
- Stars: 14
- Watchers: 1
- Forks: 14
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# fluentd-modsecurity
[Fluentd](http://fluentd.org/) output (filter) plugin for parsing a [ModSecurity](https://www.modsecurity.org/) audit log
This is intended to serve as an example starting point for how to ingest
parse entries from a ModSecurity audit log file using fluentd into a more first-class
structured object that can then be forwarded on to another output.
## Getting Started
More info and example output:
* http://bitsofinfo.wordpress.com/2013/11/11/modsecurity-audit-logs-fluentd/
ModSecurity Audit Log format:
* https://github.com/SpiderLabs/ModSecurity/wiki/ModSecurity-2-Data-Formats
* https://www.nginx.com/blog/modsecurity-logging-and-debugging/
### Prerequisites
Build the gem
```
gem build fluent-plugin-modsecurity.gemspec
```
Install the gem to fluentd
```
fluent-gem install ./fluent-plugin-modsecurity-0.2.gem
```
## Deployment
Example fluent.conf setup.
```
# (1) Consume the input
@type tail
tag raw-modsec
path /path/to/modsec_audit.log
@type multiline
format_firstline /^-{2,3}][a-zA-Z0-9]{8}-{2,3}A--$/
format1 /(?.*)/
# (2) Massage it via this plugin to a more structured object
@type modsecurity-audit-format
tag modsec-formatted
# (3) Output to stdout
@type stdout
```
## License
This project is licensed under the Apache 2.0 License - see the [LICENSE](LICENSE) file for details