1---
2filter: "Upper(evt.Parsed.program) == 'NAMED'"
3#debug: true
4onsuccess: next_stage
5pattern_syntax:
6  BIND9_TIMESTAMP_DATE: '%{MONTHDAY:ts_d}-%{MONTH:ts_m}-%{YEAR:ts_y}'
7  BIND9_TIMESTAMP_TIMEMS: '\d{3}'
8  BIND9_TIMESTAMP_TIME: '%{TIME:ts_t}\.%{BIND9_TIMESTAMP_TIMEMS:ts_ms}'
9  BIND9_TIMESTAMP: '%{BIND9_TIMESTAMP_DATE} %{BIND9_TIMESTAMP_TIME}'
10  # categories: security, client, update-security, etc.
11  BIND9_CATEGORY: '[a-z]+'
12  BIND9_SEVERITY: '[a-z]+'
13  BIND9_PREFIX: '^(%{BIND9_TIMESTAMP:timestamp} )?(%{BIND9_CATEGORY}: )?(%{BIND9_SEVERITY}: )?client (@0x[0-9a-fA-F]+ )?%{IP:remote_addr}#%{POSINT:remote_port}.*: '
14name: mstilkerich/bind9
15description: "Parse bind9 logs"
16nodes:
17  # When multiple grok patterns are specified, only the first matching one is applied
18  - grok:
19      pattern: '^%{BIND9_PREFIX}zone transfer .* (?:denied|\(NOTAUTH\))\s*$'
20      apply_on: message
21  - grok:
22      pattern: '^%{BIND9_PREFIX}bad zone transfer request: ''\S+/IN'': non-authoritative zone (?:denied|\(NOTAUTH\))\s*$'
23      apply_on: message
24  - grok:
25      pattern: '^%{BIND9_PREFIX}(?:view (?:internal|external): )?query(?: \(cache\))? .* (?:denied|\(NOTAUTH\)).*$'
26      apply_on: message
27statics:
28  - meta: service
29    value: bind9
30  - meta: log_type
31    value: bind9_denied
32  - meta: source_ip
33    expression: "evt.Parsed.remote_addr"
34  - target: evt.StrTime  # convert time format for dateparse-enrich
35    expression: "
36      {Jan:'01',Feb:'02',Mar:'03',Apr:'04',May:'05',Jun:'06',Jul:'07',Aug:'08',Sep:'09',Oct:'10',Nov:'11',Dec:'12'}[evt.Parsed.ts_m]
37      + '/' + evt.Parsed.ts_d
38      + '/' + evt.Parsed.ts_y
39      + ' ' + evt.Parsed.ts_t"
40