jordansissel · September 13, 2023 16:26 · johann8384 · Apr 18, 2014
diff --git a/README.md b/README.md
diff --git a/dashboard.json b/dashboard.json
 {
  "title": "Logstash Search",
  "services": {
    "query": {
      "list": {
        "0": {
          "query": "*",
          "alias": "",
          "color": "#7EB26D",
          "id": 0,
          "pin": false,
          "type": "lucene",
          "enable": true
        }
      },
      "ids": [
        0
      ]
    },
    "filter": {
      "list": {
        "0": {
          "type": "time",
          "field": "@timestamp",
          "from": "now-24h",
          "to": "now",
          "mandate": "must",
          "active": true,
          "alias": "",
          "id": 0
        }
      },
      "ids": [
        0
      ]
    }
  },
  "rows": [
    {
      "title": "Graph",
      "height": "350px",
      "editable": true,
      "collapse": false,
      "collapsable": true,
      "panels": [
        {
          "span": 4,
          "editable": true,
          "group": [
            "default"
          ],
          "type": "histogram",
          "mode": "count",
          "time_field": "@timestamp",
          "value_field": null,
          "auto_int": true,
          "resolution": 100,
          "interval": "1s",
          "fill": 3,
          "linewidth": 3,
          "timezone": "browser",
          "spyable": true,
          "zoomlinks": true,
          "bars": true,
          "stack": false,
          "points": false,
          "lines": false,
          "legend": true,
          "x-axis": true,
          "y-axis": true,
          "percentage": false,
          "interactive": true,
          "queries": {
            "mode": "all",
            "ids": [
              0
            ]
          },
          "title": "Events over time",
          "intervals": [
            "auto",
            "1s",
            "1m",
            "5m",
            "10m",
            "30m",
            "1h",
            "3h",
            "12h",
            "1d",
            "1w",
            "1M",
            "1y"
          ],
          "options": true,
          "tooltip": {
            "value_type": "cumulative",
            "query_as_alias": true
          },
          "scale": 1,
          "y_format": "none",
          "grid": {
            "max": null,
            "min": 0
          },
          "annotate": {
            "enable": false,
            "query": "*",
            "size": 20,
            "field": "_type",
            "sort": [
              "_score",
              "desc"
            ]
          },
          "pointradius": 5,
          "show_query": true,
          "legend_counts": true,
          "zerofill": true,
          "derivative": false
        },
        {
          "error": false,
          "span": 4,
          "editable": true,
          "type": "terms",
          "loadingEditor": false,
          "field": "procname",
          "exclude": [],
          "missing": true,
          "other": true,
          "size": 10,
          "order": "count",
          "style": {
            "font-size": "10pt"
          },
          "donut": false,
          "tilt": false,
          "labels": true,
          "arrangement": "horizontal",
          "chart": "bar",
          "counter_pos": "above",
          "spyable": true,
          "queries": {
            "mode": "all",
            "ids": [
              0
            ]
          },
          "tmode": "terms",
          "tstat": "total",
          "valuefield": "",
          "title": "Processes"
        },
        {
          "error": false,
          "span": 4,
          "editable": true,
          "type": "terms",
          "loadingEditor": false,
          "field": "event",
          "exclude": [],
          "missing": true,
          "other": true,
          "size": 10,
          "order": "count",
          "style": {
            "font-size": "10pt"
          },
          "donut": false,
          "tilt": false,
          "labels": true,
          "arrangement": "horizontal",
          "chart": "bar",
          "counter_pos": "above",
          "spyable": true,
          "queries": {
            "mode": "all",
            "ids": [
              0
            ]
          },
          "tmode": "terms",
          "tstat": "total",
          "valuefield": "",
          "title": "Top Events"
        }
      ],
      "notice": false
    },
    {
      "title": "Events",
      "height": "350px",
      "editable": true,
      "collapse": false,
      "collapsable": true,
      "panels": [
        {
          "title": "All events",
          "error": false,
          "span": 12,
          "editable": true,
          "group": [
            "default"
          ],
          "type": "table",
          "size": 100,
          "pages": 5,
          "offset": 0,
          "sort": [
            "@timestamp",
            "desc"
          ],
          "style": {
            "font-size": "9pt"
          },
          "overflow": "min-height",
          "fields": [],
          "localTime": true,
          "timeField": "@timestamp",
          "highlight": [],
          "sortable": true,
          "header": true,
          "paging": true,
          "spyable": true,
          "queries": {
            "mode": "all",
            "ids": [
              0
            ]
          },
          "field_list": true,
          "status": "Stable",
          "trimFactor": 300,
          "normTimes": true,
          "all_fields": false
        }
      ],
      "notice": false
    }
  ],
  "editable": true,
  "failover": false,
  "index": {
    "interval": "day",
    "pattern": "[sysdig-]YYYY.MM.DD",
    "default": "NO_TIME_FILTER_OR_INDEX_PATTERN_NOT_MATCHED",
    "warm_fields": true
  },
  "style": "dark",
  "panel_hints": true,
  "pulldowns": [
    {
      "type": "query",
      "collapse": false,
      "notice": false,
      "query": "*",
      "pinned": true,
      "history": [
        "",
        "-procname:sysdig AND -procname:sshd",
        "-procname:sysdig",
        "*"
      ],
      "remember": 10,
      "enable": true
    },
    {
      "type": "filtering",
      "collapse": true,
      "notice": false,
      "enable": true
    }
  ],
  "nav": [
    {
      "type": "timepicker",
      "collapse": false,
      "notice": false,
      "status": "Stable",
      "time_options": [
        "5m",
        "15m",
        "1h",
        "6h",
        "12h",
        "24h",
        "2d",
        "7d",
        "30d"
      ],
      "refresh_intervals": [
        "5s",
        "10s",
        "30s",
        "1m",
        "5m",
        "15m",
        "30m",
        "1h",
        "2h",
        "1d"
      ],
      "timefield": "@timestamp",
      "now": true,
      "filter_id": 0,
      "enable": true
    }
  ],
  "loader": {
    "save_gist": false,
    "save_elasticsearch": true,
    "save_local": true,
    "save_default": true,
    "save_temp": true,
    "save_temp_ttl_enable": true,
    "save_temp_ttl": "30d",
    "load_gist": true,
    "load_elasticsearch": true,
    "load_elasticsearch_size": 20,
    "load_local": true,
    "hide": false
  },
  "refresh": false
 }
diff --git a/logstash-sysdig.conf b/logstash-sysdig.conf
 input {
  stdin { }
 }

 filter {
  # With absolute time via `sysdig -t a`
  # <evt.num> <evt.time> <evt.cpu> <proc.name> <thread.tid> <evt.dir> <evt.type> <evt.args>
  # Example:
  # 22232 1397121223.916379436 0 sysdig (2816) < write res=62 data=3452 1397121223.855286080 0 sysdig (2816) > switch next=1822 .
  grok {
    pattern => "^%{NUMBER:num:int} %{NUMBER:time:float} %{INT:cpu:int} %{NOTSPACE:procname} %{NOTSPACE:tid} (?<direction>[<>]) %{WORD:event} %{DATA:args}$"
  }

  date {
    match => [ "time", "UNIX" ]
  }

  if [args] {
    kv {
      source => "args"
      remove_field => "args"
    }
  }
 }

 output {
  #stdout { codec => rubydebug }
  elasticsearch {
    protocol => http
    index => "sysdig-%{+YYYY.MM.dd}"
  }
 }
	{
	"title": "Logstash Search",
	"services": {
	"query": {
	"list": {
	"0": {
	"query": "*",
	"alias": "",
	"color": "#7EB26D",
	"id": 0,
	"pin": false,
	"type": "lucene",
	"enable": true
	}
	},
	"ids": [
	0
	]
	},
	"filter": {
	"list": {
	"0": {
	"type": "time",
	"field": "@timestamp",
	"from": "now-24h",
	"to": "now",
	"mandate": "must",
	"active": true,
	"alias": "",
	"id": 0
	}
	},
	"ids": [
	0
	]
	}
	},
	"rows": [
	{
	"title": "Graph",
	"height": "350px",
	"editable": true,
	"collapse": false,
	"collapsable": true,
	"panels": [
	{
	"span": 4,
	"editable": true,
	"group": [
	"default"
	],
	"type": "histogram",
	"mode": "count",
	"time_field": "@timestamp",
	"value_field": null,
	"auto_int": true,
	"resolution": 100,
	"interval": "1s",
	"fill": 3,
	"linewidth": 3,
	"timezone": "browser",
	"spyable": true,
	"zoomlinks": true,
	"bars": true,
	"stack": false,
	"points": false,
	"lines": false,
	"legend": true,
	"x-axis": true,
	"y-axis": true,
	"percentage": false,
	"interactive": true,
	"queries": {
	"mode": "all",
	"ids": [
	0
	]
	},
	"title": "Events over time",
	"intervals": [
	"auto",
	"1s",
	"1m",
	"5m",
	"10m",
	"30m",
	"1h",
	"3h",
	"12h",
	"1d",
	"1w",
	"1M",
	"1y"
	],
	"options": true,
	"tooltip": {
	"value_type": "cumulative",
	"query_as_alias": true
	},
	"scale": 1,
	"y_format": "none",
	"grid": {
	"max": null,
	"min": 0
	},
	"annotate": {
	"enable": false,
	"query": "*",
	"size": 20,
	"field": "_type",
	"sort": [
	"_score",
	"desc"
	]
	},
	"pointradius": 5,
	"show_query": true,
	"legend_counts": true,
	"zerofill": true,
	"derivative": false
	},
	{
	"error": false,
	"span": 4,
	"editable": true,
	"type": "terms",
	"loadingEditor": false,
	"field": "procname",
	"exclude": [],
	"missing": true,
	"other": true,
	"size": 10,
	"order": "count",
	"style": {
	"font-size": "10pt"
	},
	"donut": false,
	"tilt": false,
	"labels": true,
	"arrangement": "horizontal",
	"chart": "bar",
	"counter_pos": "above",
	"spyable": true,
	"queries": {
	"mode": "all",
	"ids": [
	0
	]
	},
	"tmode": "terms",
	"tstat": "total",
	"valuefield": "",
	"title": "Processes"
	},
	{
	"error": false,
	"span": 4,
	"editable": true,
	"type": "terms",
	"loadingEditor": false,
	"field": "event",
	"exclude": [],
	"missing": true,
	"other": true,
	"size": 10,
	"order": "count",
	"style": {
	"font-size": "10pt"
	},
	"donut": false,
	"tilt": false,
	"labels": true,
	"arrangement": "horizontal",
	"chart": "bar",
	"counter_pos": "above",
	"spyable": true,
	"queries": {
	"mode": "all",
	"ids": [
	0
	]
	},
	"tmode": "terms",
	"tstat": "total",
	"valuefield": "",
	"title": "Top Events"
	}
	],
	"notice": false
	},
	{
	"title": "Events",
	"height": "350px",
	"editable": true,
	"collapse": false,
	"collapsable": true,
	"panels": [
	{
	"title": "All events",
	"error": false,
	"span": 12,
	"editable": true,
	"group": [
	"default"
	],
	"type": "table",
	"size": 100,
	"pages": 5,
	"offset": 0,
	"sort": [
	"@timestamp",
	"desc"
	],
	"style": {
	"font-size": "9pt"
	},
	"overflow": "min-height",
	"fields": [],
	"localTime": true,
	"timeField": "@timestamp",
	"highlight": [],
	"sortable": true,
	"header": true,
	"paging": true,
	"spyable": true,
	"queries": {
	"mode": "all",
	"ids": [
	0
	]
	},
	"field_list": true,
	"status": "Stable",
	"trimFactor": 300,
	"normTimes": true,
	"all_fields": false
	}
	],
	"notice": false
	}
	],
	"editable": true,
	"failover": false,
	"index": {
	"interval": "day",
	"pattern": "[sysdig-]YYYY.MM.DD",
	"default": "NO_TIME_FILTER_OR_INDEX_PATTERN_NOT_MATCHED",
	"warm_fields": true
	},
	"style": "dark",
	"panel_hints": true,
	"pulldowns": [
	{
	"type": "query",
	"collapse": false,
	"notice": false,
	"query": "*",
	"pinned": true,
	"history": [
	"",
	"-procname:sysdig AND -procname:sshd",
	"-procname:sysdig",
	"*"
	],
	"remember": 10,
	"enable": true
	},
	{
	"type": "filtering",
	"collapse": true,
	"notice": false,
	"enable": true
	}
	],
	"nav": [
	{
	"type": "timepicker",
	"collapse": false,
	"notice": false,
	"status": "Stable",
	"time_options": [
	"5m",
	"15m",
	"1h",
	"6h",
	"12h",
	"24h",
	"2d",
	"7d",
	"30d"
	],
	"refresh_intervals": [
	"5s",
	"10s",
	"30s",
	"1m",
	"5m",
	"15m",
	"30m",
	"1h",
	"2h",
	"1d"
	],
	"timefield": "@timestamp",
	"now": true,
	"filter_id": 0,
	"enable": true
	}
	],
	"loader": {
	"save_gist": false,
	"save_elasticsearch": true,
	"save_local": true,
	"save_default": true,
	"save_temp": true,
	"save_temp_ttl_enable": true,
	"save_temp_ttl": "30d",
	"load_gist": true,
	"load_elasticsearch": true,
	"load_elasticsearch_size": 20,
	"load_local": true,
	"hide": false
	},
	"refresh": false
	}
	input {
	stdin { }
	}

	filter {
	# With absolute time via `sysdig -t a`
	# <evt.num> <evt.time> <evt.cpu> <proc.name> <thread.tid> <evt.dir> <evt.type> <evt.args>
	# Example:
	# 22232 1397121223.916379436 0 sysdig (2816) < write res=62 data=3452 1397121223.855286080 0 sysdig (2816) > switch next=1822 .
	grok {
	pattern => "^%{NUMBER:num:int} %{NUMBER:time:float} %{INT:cpu:int} %{NOTSPACE:procname} %{NOTSPACE:tid} (?<direction>[<>]) %{WORD:event} %{DATA:args}$"
	}

	date {
	match => [ "time", "UNIX" ]
	}

	if [args] {
	kv {
	source => "args"
	remove_field => "args"
	}
	}
	}

	output {
	#stdout { codec => rubydebug }
	elasticsearch {
	protocol => http
	index => "sysdig-%{+YYYY.MM.dd}"
	}
	}