Ensure [log][file][path] groked before script
cs_makebeaconlogpath.rb is executed before  [log][file][path] is parsed
@@ -65,11 +65,6 @@ filter {
# Parsed by filebeat as c2.log.type:beacon
#
if [c2][log][type] == "beacon" {
- # Add path/URI value to the full beacon.log file
- ruby {
- path => "/usr/share/logstash/redelk-main/scripts/cs_makebeaconlogpath.rb"
- }
-
# Set the beacon id from the file name
# Need to match for 3 different occurence:
# - one where it states 'unknown'.
@@ -84,6 +79,11 @@ filter {
] }
}
+ # Add path/URI value to the full beacon.log file
+ ruby {
+ path => "/usr/share/logstash/redelk-main/scripts/cs_makebeaconlogpath.rb"
+ }
+
# matching lines like: [metadata] 1.2.3.4 <- 10.10.10.10; computer: SomeComputername; user: SomeUsername; pid: 7368; os: Windows; version: 6.1; beacon arch: x86
# todo: this could go wrong if targetip is not an ip but a smb/TCP beacon (can list the beacon session id instead of ip address..? In such case also set the beacon_link value to true
if "[metadata] " in [c2][message] {
