amavis-logs

1onsuccess: next_stage1
2name: crowdsecurity/amavis-logs
3description: "Parse amavis logs"
4filter: "evt.Parsed.program == 'amavis'"2
5pattern_syntax:3
6  AMAVIS_MESSAGEID: "Message-ID: <%{DATA:amavis_message-id}>"
7  AMAVIS_SIZE: "size: %{POSINT:amavis_size}"
8  AMAVIS_TESTS: 'Tests: \[%{DATA:amavis_tests}\]'
9  AMAVIS_FROM: "From: %{DATA:amavis_header_from}"
10  AMAVIS_HITS: "Hits: %{NUMBER:amavis_hits}"
11  AMAVIS_QUARANTINE: "quarantine: %{NOTSPACE:amavis_quarantine}"
12  AMAVIS_SUBJECT: 'Subject: "%{DATA:amavis_subject}"'
13  AMAVIS_KV: "((%{AMAVIS_MESSAGEID}|%{AMAVIS_SIZE}|%{AMAVIS_TESTS}|%{AMAVIS_FROM}|%{AMAVIS_HITS}|%{AMAVIS_QUARANTINE}|%{AMAVIS_SUBJECT}|%{DATA}), )*"
14  AMAVIS: '\(%{DATA:amavis_id}\) %{WORD:amavis_action} %{NOTSPACE:amavis_category}( \(%{DATA:amavis_match}\))( \{%{DATA:amavis_acions}\})?, \[(IPv6:)?%{IP:amavis_relay_ip}\]:%{POSINT:src_port} \[(IPv6:)?%{IP:amavis_amavis_origin_ip}\] <%{DATA:amavis_from}> -> <%{DATA:amavis_to}>, %{AMAVIS_KV}%{POSINT:amavis_elapsedtime} ms'
15grok:4
16  name: "AMAVIS"
17  apply_on: message
18statics:5
19  - meta: service
20    value: amavis
21  - meta: log_type
22    value: "amavis"
23  - meta: source_ip
24    expression: "evt.Parsed.amavis_relay_ip"
25  - meta: amavis_category
26    expression: "evt.Parsed.amavis_category"
27  - meta: amavis_match
28    expression: "evt.Parsed.amavis_match"