1name: bouddha-fr/opensearch-dashboard-logs
2description: "Parse OpenSearch web interface logs for failed login attempts"
3filter: "evt.Parsed.program == 'opensearch-dashboards' && UnmarshalJSON(evt.Parsed.message, evt.Unmarshaled, 'opensearch') in ['', nil]"
4onsuccess: next_stage
5statics:
6  - meta: service
7    value: opensearch
8  - meta: source_ip
9    expression: evt.Unmarshaled.opensearch.req.remoteAddress
10  - meta: log_type
11    expression: |
12        (
13          evt.Unmarshaled.opensearch.type == 'response' &&
14          evt.Unmarshaled.opensearch.method == 'post' &&
15          evt.Unmarshaled.opensearch.statusCode in [401, '401'] &&
16          evt.Unmarshaled.opensearch.req.url == '/auth/login?dataSourceId='
17        ) ? 'opensearch_failed_auth' : ''
18  - meta: timestamp
19    expression: evt.Unmarshaled.opensearch['@timestamp']
20  - meta: status_code
21    expression: evt.Unmarshaled.opensearch.statusCode
22  - meta: url
23    expression: evt.Unmarshaled.opensearch.req.url
24  - target: evt.StrTime
25    expression: evt.Unmarshaled.opensearch['@timestamp']
26