Removed submodule logstash-modsecurity

OWASP · Jan 9, 2020 · 7664822 · 7664822
1 parent 51d6f85
commit 7664822
Show file tree

Hide file tree

Showing 3 changed files with 9 additions and 4 deletions.
diff --git a/.gitmodules b/.gitmodules
@@ -1,4 +1 @@
 
-[submodule "honeytraps/waf_elk/logstash/logstash-modsecurity"]
-	path = honeytraps/waf_elk/logstash/logstash-modsecurity
-	url = https://github.com/bitsofinfo/logstash-modsecurity
diff --git a/honeytraps/waf_elk/logstash/logstash-modsecurity b/honeytraps/waf_elk/logstash/logstash-modsecurity
diff --git a/honeytraps/waf_elk/logstash/pipeline/logstash.conf b/honeytraps/waf_elk/logstash/pipeline/logstash.conf
@@ -1,10 +1,19 @@
 input {
   beats {
     port => 5044
+    type => "mod_security"
     codec => json
   }
 }
 
+#filter {
+#  if [type] == "mod_security" {
+#    grok {
+#        match => { "[audit_data][messages]" => 'ARGS:%{DATA}: %{DATA:m_data}"]'}
+#    }
+#  }
+#}
+
 output {
   elasticsearch {
     hosts => "elasticsearch:9200"