<div id="readability-page-1" class="page"><div id="post-body-3450014825867194011" itemprop="articleBody">
audit.log 연동.
<div><pre><code>filter {&nbsp;mutate {&nbsp; remove_field =&gt; ["@timestamp", "@version", "path", "host"]&nbsp;}&nbsp;kv {}&nbsp;dissect {&nbsp; mapping =&gt; {"msg" =&gt; "%{}(%{timestamp}:%{}"}&nbsp;}}</code></pre></div><div><pre><code>{&nbsp; &nbsp; &nbsp; &nbsp;"family" =&gt; "10",&nbsp; &nbsp; &nbsp; "message" =&gt; "type=NETFILTER_CFG msg=audit(1745768855.720:63): table=filter family=10 entries=0\r",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;"type" =&gt; "NETFILTER_CFG",&nbsp; &nbsp; &nbsp; "entries" =&gt; "0\r",&nbsp; &nbsp; "timestamp" =&gt; "1745768855.720",&nbsp; &nbsp; &nbsp; &nbsp; "table" =&gt; "filter",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "msg" =&gt; "audit(1745768855.720:63):"}{&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "gid" =&gt; "0",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;"a2" =&gt; "41a2d8",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;"a0" =&gt; "1e2da20",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;"ppid" =&gt; "1335",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "key" =&gt; "(null)\r",&nbsp; &nbsp; "timestamp" =&gt; "1745768855.720",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;"a1" =&gt; "1d75",&nbsp; &nbsp; &nbsp; &nbsp; "fsgid" =&gt; "0",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "tty" =&gt; "none",&nbsp; &nbsp; &nbsp; "message" =&gt; "type=SYSCALL msg=audit(1745768855.720:63): arch=c000003e syscall=175 success=yes exit=0 a0=1e2da20 a1=1d75 a2=41a2d8 a3=1e2a500 items=0 ppid=1335 pid=1336 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"modprobe\" exe=\"/usr/bin/kmod\" subj=system_u:system_r:insmod_t:s0 key=(null)\r",&nbsp; &nbsp; &nbsp; &nbsp; "items" =&gt; "0",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;"suid" =&gt; "0",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;"auid" =&gt; "4294967295",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;"sgid" =&gt; "0",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "pid" =&gt; "1336",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;"egid" =&gt; "0",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "exe" =&gt; "/usr/bin/kmod",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "uid" =&gt; "0",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "ses" =&gt; "4294967295",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;"a3" =&gt; "1e2a500",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;"euid" =&gt; "0",&nbsp; &nbsp; &nbsp; &nbsp; "fsuid" =&gt; "0",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;"comm" =&gt; "modprobe",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;"exit" =&gt; "0",&nbsp; &nbsp; &nbsp; "success" =&gt; "yes",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "msg" =&gt; "audit(1745768855.720:63):",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;"arch" =&gt; "c000003e",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;"subj" =&gt; "system_u:system_r:insmod_t:s0",&nbsp; &nbsp; &nbsp; "syscall" =&gt; "175",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;"type" =&gt; "SYSCALL"}</code></pre></div>

그런데 시간 정보가 unixtime 포맷이다. stackoverflow 형님들이 가르쳐준대로 date 포맷으로 변경.
<div><pre><code>filter {&nbsp;mutate {&nbsp; remove_field =&gt; ["@timestamp", "@version", "path", "host"]&nbsp;}&nbsp;kv {}&nbsp;dissect {&nbsp; mapping =&gt; {"msg" =&gt; "%{}(%{timestamp}:%{}"}&nbsp;}&nbsp;ruby {&nbsp; code =&gt; "event.set('@timestamp', DateTime.strptime(event.get('timestamp'), '%s'))"&nbsp;}}</code></pre></div>
<pre><code>[2025-04-28T17:52:41,760][ERROR][logstash.filters.ruby&nbsp; &nbsp; ][main][7cefa12dcafdc101f42a5bda6812294cab6405d0864ef044fe35a2cc66392ce4] Ruby exception occurred: wrong argument type DateTime (expected LogStash::Timestamp)</code></pre>
안 된다. 제미나이한테 물어봄.
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiGeOvSsV-noI1Rwoxwxq5x8-pdYXn5lNuIW8E2m-KCnmBmYB_BOVdDnhyphenhyphen125gPdMNB7Do1iR5nkMd0qAc0OFQZ7CQQm1mFwXEhiwmdsLCzTPrW4CjZzPN4GJq9BLZlTbfAiF-iIfOk2mWuJJ_DgzkUWvCxZ6s2FCDEKzQUmG4ouKRGbPnVuHVRln7UJ0nR/s1004/gemini.png"><img data-original-height="720" data-original-width="1004" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiGeOvSsV-noI1Rwoxwxq5x8-pdYXn5lNuIW8E2m-KCnmBmYB_BOVdDnhyphenhyphen125gPdMNB7Do1iR5nkMd0qAc0OFQZ7CQQm1mFwXEhiwmdsLCzTPrW4CjZzPN4GJq9BLZlTbfAiF-iIfOk2mWuJJ_DgzkUWvCxZ6s2FCDEKzQUmG4ouKRGbPnVuHVRln7UJ0nR/s16000/gemini.png"></a><pre><code>[2025-04-28T17:57:02,837][ERROR][logstash.filters.ruby&nbsp; &nbsp; ][main][d35de4494869054b8277f75d5c334da579e561ff0060cc7554ec4beb7dd79661] Ruby exception occurred: wrong argument type DateTime (expected Time)</code></pre>
안 되잖아(..)
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi0wICj6cEEXc16f5xI2nOtfZFuNztd72PGFkeJpridAmrQhvyeDtExoPRGi6JbX4TI_RqYmeAn9KxlBViEUJTntI7C0-n3tE8MQ8x5q07z5rhkk5a0zZbIqn4rOG9zT2icLbwoVxIgIHcNx5M_LpC3r2oiV12cisIK6qdjY8jWDKIXe4z_976hf5PJ1M8v/s1054/gemini2.png"><img data-original-height="720" data-original-width="1054" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi0wICj6cEEXc16f5xI2nOtfZFuNztd72PGFkeJpridAmrQhvyeDtExoPRGi6JbX4TI_RqYmeAn9KxlBViEUJTntI7C0-n3tE8MQ8x5q07z5rhkk5a0zZbIqn4rOG9zT2icLbwoVxIgIHcNx5M_LpC3r2oiV12cisIK6qdjY8jWDKIXe4z_976hf5PJ1M8v/s16000/gemini2.png"></a>아무래도 로그스태시 구문이 따로 있는 것 같은데 ruby 구문을 계속 그대로 사용하는 게 이상하다. gpt는 다를까?
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi_WWp5Pf0JmDF3aqeoyy5aHvibuQD6cOFzhBquTaAcy51b6hIZ1sG2zDA2i3SSGv2w5dBnRHrvE9oHnD-ftO8pFngHpHjIG013Giz9eMDnAbM4k8WQWB5yoTfMxpmGlIqYxE20KVSaFeqdgJhtVnGoflB-RRhjqTVKpoqDoK6vx18Xy-KlFiGsj58Qu8aO/s939/chatgpt.png"><img data-original-height="720" data-original-width="939" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi_WWp5Pf0JmDF3aqeoyy5aHvibuQD6cOFzhBquTaAcy51b6hIZ1sG2zDA2i3SSGv2w5dBnRHrvE9oHnD-ftO8pFngHpHjIG013Giz9eMDnAbM4k8WQWB5yoTfMxpmGlIqYxE20KVSaFeqdgJhtVnGoflB-RRhjqTVKpoqDoK6vx18Xy-KlFiGsj58Qu8aO/s16000/chatgpt.png"></a>
<div><pre><code>filter {&nbsp;mutate {&nbsp; remove_field =&gt; ["@timestamp", "@version", "path", "host"]&nbsp;}&nbsp;kv {}&nbsp;dissect {&nbsp; mapping =&gt; {"msg" =&gt; "%{}(%{timestamp}:%{}"}&nbsp;}&nbsp;ruby {&nbsp; code =&gt; "event.set('@timestamp', LogStash::Timestamp.new(Time.at(event.get('timestamp').to_i)))"&nbsp;}}</code></pre></div>
<div><pre><code>{&nbsp; &nbsp; &nbsp; &nbsp; "family" =&gt; "10",&nbsp; &nbsp; &nbsp; &nbsp;"message" =&gt; "type=NETFILTER_CFG msg=audit(1745768855.720:63): table=filter family=10 entries=0\r",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "type" =&gt; "NETFILTER_CFG",&nbsp; &nbsp; &nbsp; &nbsp;"entries" =&gt; "0\r",&nbsp; &nbsp; &nbsp;"timestamp" =&gt; "1745768855.720",&nbsp; &nbsp; "@timestamp" =&gt; 2025-04-27T15:47:35.000Z,&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;"table" =&gt; "filter",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;"msg" =&gt; "audit(1745768855.720:63):"}{&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;"gid" =&gt; "0",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "a2" =&gt; "41a2d8",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "a0" =&gt; "1e2da20",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "ppid" =&gt; "1335",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;"key" =&gt; "(null)\r",&nbsp; &nbsp; &nbsp;"timestamp" =&gt; "1745768855.720",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "a1" =&gt; "1d75",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;"fsgid" =&gt; "0",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;"tty" =&gt; "none",&nbsp; &nbsp; &nbsp; &nbsp;"message" =&gt; "type=SYSCALL msg=audit(1745768855.720:63): arch=c000003e syscall=175 success=yes exit=0 a0=1e2da20 a1=1d75 a2=41a2d8 a3=1e2a500 items=0 ppid=1335 pid=1336 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"modprobe\" exe=\"/usr/bin/kmod\" subj=system_u:system_r:insmod_t:s0 key=(null)\r",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;"items" =&gt; "0",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "suid" =&gt; "0",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "auid" =&gt; "4294967295",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "sgid" =&gt; "0",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;"pid" =&gt; "1336",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "egid" =&gt; "0",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;"exe" =&gt; "/usr/bin/kmod",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;"uid" =&gt; "0",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;"ses" =&gt; "4294967295",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "a3" =&gt; "1e2a500",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "euid" =&gt; "0",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;"fsuid" =&gt; "0",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "comm" =&gt; "modprobe",&nbsp; &nbsp; "@timestamp" =&gt; 2025-04-27T15:47:35.000Z,&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "exit" =&gt; "0",&nbsp; &nbsp; &nbsp; &nbsp;"success" =&gt; "yes",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;"msg" =&gt; "audit(1745768855.720:63):",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "arch" =&gt; "c000003e",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "subj" =&gt; "system_u:system_r:insmod_t:s0",&nbsp; &nbsp; &nbsp; &nbsp;"syscall" =&gt; "175",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "type" =&gt; "SYSCALL"}</code></pre></div>
아이고 구글(..)<div>관련&nbsp;글<ul><li><a href="https://kangmyounghun.blogspot.com/2025/03/logstash-ruby-7th.html">Logstash 필터 ruby - 7th</a></li><li><a href="http://kangmyounghun.blogspot.kr/2017/10/logstash-ruby.html" target="">Logstash 필터 ruby</a></li><li><a href="http://kangmyounghun.blogspot.com/2017/06/elasticsearch-grok.html" target="_blank">Logstash 필터 grok</a></li><li><a href="http://kangmyounghun.blogspot.com/2017/07/logstash-mutate.html" target="_blank">Logstash 필터 mutate</a></li><li><a href="http://kangmyounghun.blogspot.kr/2018/02/logstash-geoip.html" target="_blank">Logstash 필터&nbsp;geoip</a></li><li><a href="http://kangmyounghun.blogspot.kr/2018/04/logstash-dissect.html" target="_blank">Logstash 필터 dissect</a></li><li><a href="http://kangmyounghun.blogspot.com/2018/09/logstash-kv.html" target="_blank">Logstash 필터&nbsp;kv</a></li><li><a href="https://kangmyounghun.blogspot.com/2019/01/logstash-date.html" target="_blank">Logstash 필터 date</a></li><li><a href="https://kangmyounghun.blogspot.com/2019/02/logstash-translate.html" target="_blank">Logstash 필터 translate</a></li><li><a href="https://kangmyounghun.blogspot.com/2019/08/logstash-drop.html" target="_blank">Logstash 필터 drop</a></li><li><a href="https://kangmyounghun.blogspot.com/2019/11/logstash-useragent.html" target="_blank">Logstash 필터 useragent</a></li><li><a href="https://kangmyounghun.blogspot.com/2020/02/logstash-elapsed.html" target="_blank">Logstash 필터 elapsed</a></li><li><a href="https://kangmyounghun.blogspot.com/2020/04/logstash-fingerprint.html" target="_blank">Logstash 필터 fingerprint</a></li><li><a href="https://kangmyounghun.blogspot.com/2022/12/logstash-csv.html" target="_blank">Logstash 필터 csv</a></li><li><a href="https://kangmyounghun.blogspot.com/2023/11/logstash-dns.html">Logstash 필터 dns</a></li><li><a href="https://kangmyounghun.blogspot.com/2025/01/logstash-split.html">Logstash 필터 split</a></li><li><a href="https://kangmyounghun.blogspot.com/2020/02/logstash-codec-multiline.html" target="_blank">Logstash codec 플러그인 multiline</a></li></ul></div>

</div></div>

케세라세라

audit.log 연동.
filter {
 mutate {
  remove_field => ["@timestamp", "@version", "path", "host"]
 }
 kv {}
 dissect {
  mapping => {"msg" => "%{}(%{timestamp}:%{}"}
 }
}
{
       "family" => "10",
      "message" => "type=NETFILTER_CFG msg=audit(1745768855.720:63): table=filter family=10 entries=0\r",
         "type" => "NETFILTER_CFG",
      "entries" => "0\r",
    "timestamp" => "1745768855.720",
        "table" => "filter",
          "msg" => "audit(1745768855.720:63):"
}
{
          "gid" => "0",
           "a2" => "41a2d8",
           "a0" => "1e2da20",
         "ppid" => "1335",
          "key" => "(null)\r",
    "timestamp" => "1745768855.720",
           "a1" => "1d75",
        "fsgid" => "0",
          "tty" => "none",
      "message" => "type=SYSCALL msg=audit(1745768855.720:63): arch=c000003e syscall=175 success=yes exit=0 a0=1e2da20 a1=1d75 a2=41a2d8 a3=1e2a500 items=0 ppid=1335 pid=1336 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"modprobe\" exe=\"/usr/bin/kmod\" subj=system_u:system_r:insmod_t:s0 key=(null)\r",
        "items" => "0",
         "suid" => "0",
         "auid" => "4294967295",
         "sgid" => "0",
          "pid" => "1336",
         "egid" => "0",
          "exe" => "/usr/bin/kmod",
          "uid" => "0",
          "ses" => "4294967295",
           "a3" => "1e2a500",
         "euid" => "0",
        "fsuid" => "0",
         "comm" => "modprobe",
         "exit" => "0",
      "success" => "yes",
          "msg" => "audit(1745768855.720:63):",
         "arch" => "c000003e",
         "subj" => "system_u:system_r:insmod_t:s0",
      "syscall" => "175",
         "type" => "SYSCALL"
}
그런데 시간 정보가 unixtime 포맷이다. stackoverflow 형님들이 가르쳐준대로 date 포맷으로 변경.
filter {
 mutate {
  remove_field => ["@timestamp", "@version", "path", "host"]
 }
 kv {}
 dissect {
  mapping => {"msg" => "%{}(%{timestamp}:%{}"}
 }
 ruby {
  code => "event.set('@timestamp', DateTime.strptime(event.get('timestamp'), '%s'))"
 }
}
[2025-04-28T17:52:41,760][ERROR][logstash.filters.ruby    ][main][7cefa12dcafdc101f42a5bda6812294cab6405d0864ef044fe35a2cc66392ce4] 
Ruby exception occurred: wrong argument type DateTime (expected LogStash::Timestamp)
안 된다. 제미나이한테 물어봄.
[2025-04-28T17:57:02,837][ERROR][logstash.filters.ruby    ][main][d35de4494869054b8277f75d5c334da579e561ff0060cc7554ec4beb7dd79661] 
Ruby exception occurred: wrong argument type DateTime (expected Time)
안 되잖아(..)
아무래도 로그스태시 구문이 따로 있는 것 같은데 ruby 구문을 계속 그대로 사용하는 게 이상하다. gpt는 다를까?
filter {
 mutate {
  remove_field => ["@timestamp", "@version", "path", "host"]
 }
 kv {}
 dissect {
  mapping => {"msg" => "%{}(%{timestamp}:%{}"}
 }
 ruby {
  code => "event.set('@timestamp', LogStash::Timestamp.new(Time.at(event.get('timestamp').to_i)))"
 }
}
{
        "family" => "10",
       "message" => "type=NETFILTER_CFG msg=audit(1745768855.720:63): table=filter family=10 entries=0\r",
          "type" => "NETFILTER_CFG",
       "entries" => "0\r",
     "timestamp" => "1745768855.720",
    "@timestamp" => 2025-04-27T15:47:35.000Z,
         "table" => "filter",
           "msg" => "audit(1745768855.720:63):"
}
{
           "gid" => "0",
            "a2" => "41a2d8",
            "a0" => "1e2da20",
          "ppid" => "1335",
           "key" => "(null)\r",
     "timestamp" => "1745768855.720",
            "a1" => "1d75",
         "fsgid" => "0",
           "tty" => "none",
       "message" => "type=SYSCALL msg=audit(1745768855.720:63): arch=c000003e syscall=175 success=yes exit=0 a0=1e2da20 a1=1d75 a2=41a2d8 a3=1e2a500 items=0 ppid=1335 pid=1336 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"modprobe\" exe=\"/usr/bin/kmod\" subj=system_u:system_r:insmod_t:s0 key=(null)\r",
         "items" => "0",
          "suid" => "0",
          "auid" => "4294967295",
          "sgid" => "0",
           "pid" => "1336",
          "egid" => "0",
           "exe" => "/usr/bin/kmod",
           "uid" => "0",
           "ses" => "4294967295",
            "a3" => "1e2a500",
          "euid" => "0",
         "fsuid" => "0",
          "comm" => "modprobe",
    "@timestamp" => 2025-04-27T15:47:35.000Z,
          "exit" => "0",
       "success" => "yes",
           "msg" => "audit(1745768855.720:63):",
          "arch" => "c000003e",
          "subj" => "system_u:system_r:insmod_t:s0",
       "syscall" => "175",
          "type" => "SYSCALL"
}
아이고 구글(..)
관련 글
Logstash 필터 ruby - 7th
Logstash 필터 ruby
Logstash 필터 grok
Logstash 필터 mutate
Logstash 필터 geoip
Logstash 필터 dissect
Logstash 필터 kv
Logstash 필터 date
Logstash 필터 translate
Logstash 필터 drop
Logstash 필터 useragent
Logstash 필터 elapsed
Logstash 필터 fingerprint
Logstash 필터 csv
Logstash 필터 dns
Logstash 필터 split
Logstash codec 플러그인 multiline

Logstash 필터 ruby - 8th

댓글