{"action":"created","issue":{"url":"https://api.github.com/repos/dsvetlov/lightsiem/issues/13","labels_url":"https://api.github.com/repos/dsvetlov/lightsiem/issues/13/labels{/name}","comments_url":"https://api.github.com/repos/dsvetlov/lightsiem/issues/13/comments","events_url":"https://api.github.com/repos/dsvetlov/lightsiem/issues/13/events","html_url":"https://github.com/dsvetlov/lightsiem/issues/13","id":71877652,"number":13,"title":"Parsing Src_IP from logs to geo-locate events","user":{"login":"craiglawson","id":5032473,"avatar_url":"https://avatars.githubusercontent.com/u/5032473?v=3","gravatar_id":"","url":"https://api.github.com/users/craiglawson","html_url":"https://github.com/craiglawson","followers_url":"https://api.github.com/users/craiglawson/followers","following_url":"https://api.github.com/users/craiglawson/following{/other_user}","gists_url":"https://api.github.com/users/craiglawson/gists{/gist_id}","starred_url":"https://api.github.com/users/craiglawson/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/craiglawson/subscriptions","organizations_url":"https://api.github.com/users/craiglawson/orgs","repos_url":"https://api.github.com/users/craiglawson/repos","events_url":"https://api.github.com/users/craiglawson/events{/privacy}","received_events_url":"https://api.github.com/users/craiglawson/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/dsvetlov/lightsiem/labels/enhancement","name":"enhancement","color":"84b6eb"},{"url":"https://api.github.com/repos/dsvetlov/lightsiem/labels/kibana","name":"kibana","color":"5319e7"},{"url":"https://api.github.com/repos/dsvetlov/lightsiem/labels/logstash","name":"logstash","color":"bfdadc"},{"url":"https://api.github.com/repos/dsvetlov/lightsiem/labels/ossec","name":"ossec","color":"fad8c7"}],"state":"open","locked":false,"assignee":{"login":"dsvetlov","id":6923044,"avatar_url":"https://avatars.githubusercontent.com/u/6923044?v=3","gravatar_id":"","url":"https://api.github.com/users/dsvetlov","html_url":"https://github.com/dsvetlov","followers_url":"https://api.github.com/users/dsvetlov/followers","following_url":"https://api.github.com/users/dsvetlov/following{/other_user}","gists_url":"https://api.github.com/users/dsvetlov/gists{/gist_id}","starred_url":"https://api.github.com/users/dsvetlov/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dsvetlov/subscriptions","organizations_url":"https://api.github.com/users/dsvetlov/orgs","repos_url":"https://api.github.com/users/dsvetlov/repos","events_url":"https://api.github.com/users/dsvetlov/events{/privacy}","received_events_url":"https://api.github.com/users/dsvetlov/received_events","type":"User","site_admin":false},"milestone":{"url":"https://api.github.com/repos/dsvetlov/lightsiem/milestones/2","html_url":"https://github.com/dsvetlov/lightsiem/milestones/Version%200.2","labels_url":"https://api.github.com/repos/dsvetlov/lightsiem/milestones/2/labels","id":1053529,"number":2,"title":"Version 0.2","description":"","creator":{"login":"dsvetlov","id":6923044,"avatar_url":"https://avatars.githubusercontent.com/u/6923044?v=3","gravatar_id":"","url":"https://api.github.com/users/dsvetlov","html_url":"https://github.com/dsvetlov","followers_url":"https://api.github.com/users/dsvetlov/followers","following_url":"https://api.github.com/users/dsvetlov/following{/other_user}","gists_url":"https://api.github.com/users/dsvetlov/gists{/gist_id}","starred_url":"https://api.github.com/users/dsvetlov/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dsvetlov/subscriptions","organizations_url":"https://api.github.com/users/dsvetlov/orgs","repos_url":"https://api.github.com/users/dsvetlov/repos","events_url":"https://api.github.com/users/dsvetlov/events{/privacy}","received_events_url":"https://api.github.com/users/dsvetlov/received_events","type":"User","site_admin":false},"open_issues":8,"closed_issues":0,"state":"open","created_at":"2015-04-05T18:09:37Z","updated_at":"2015-04-29T19:16:38Z","due_on":null,"closed_at":null},"comments":3,"created_at":"2015-04-29T13:36:15Z","updated_at":"2015-05-01T09:29:35Z","closed_at":null,"body":"I am struggling to get the source IP to parse from the message, My aim of this is to then geo-locate the IP on a map so you can easily see to a view where traffic is originating from.\r\n\r\nI have already enabled geo-location in OSSEC as per - http://blog.rootshell.be/2012/06/05/attackers-geolocation-in-ossec/ and the alerts.log now has a Src IP and Src Location in the alert messages.\r\n\r\nI have previously got this working using the OSSEC + ELK VM provided by OSSEC, but can't get it working with LightSIEM... :(\r\n\r\nFYI - I added this to logstash.conf on my OSSEC provided VM:\r\n\r\n    geoip {\r\n      source => \"Src_IP\"\r\n      target => \"geoip\"\r\n      add_field => [ \"[geoip][coordinates]\", \"%{[geoip][longitude]}\" ]\r\n      add_field => [ \"[geoip][coordinates]\", \"%{[geoip][latitude]}\"  ]\r\n    }\r\n\r\n\r\nThanks,\r\n\r\nCraig\r\n"},"comment":{"url":"https://api.github.com/repos/dsvetlov/lightsiem/issues/comments/98085018","html_url":"https://github.com/dsvetlov/lightsiem/issues/13#issuecomment-98085018","issue_url":"https://api.github.com/repos/dsvetlov/lightsiem/issues/13","id":98085018,"user":{"login":"craiglawson","id":5032473,"avatar_url":"https://avatars.githubusercontent.com/u/5032473?v=3","gravatar_id":"","url":"https://api.github.com/users/craiglawson","html_url":"https://github.com/craiglawson","followers_url":"https://api.github.com/users/craiglawson/followers","following_url":"https://api.github.com/users/craiglawson/following{/other_user}","gists_url":"https://api.github.com/users/craiglawson/gists{/gist_id}","starred_url":"https://api.github.com/users/craiglawson/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/craiglawson/subscriptions","organizations_url":"https://api.github.com/users/craiglawson/orgs","repos_url":"https://api.github.com/users/craiglawson/repos","events_url":"https://api.github.com/users/craiglawson/events{/privacy}","received_events_url":"https://api.github.com/users/craiglawson/received_events","type":"User","site_admin":false},"created_at":"2015-05-01T09:29:35Z","updated_at":"2015-05-01T09:29:35Z","body":"By adding the following line to \"20-ossec.conf\":\r\n\r\ngrok {\r\n  match => { \"message\" => \"srcip: %{IP:Originating.IP}\" }\r\n}\r\n\r\nI am now able to extract the IP from the message, does this seem like a suitable way of extracting the information? I'm not sure what naming scheme you would prefer to use so I used Originating.IP in my test."}}