{"action":"created","issue":{"url":"https://api.github.com/repos/bitsofinfo/logstash-modsecurity/issues/18","labels_url":"https://api.github.com/repos/bitsofinfo/logstash-modsecurity/issues/18/labels{/name}","comments_url":"https://api.github.com/repos/bitsofinfo/logstash-modsecurity/issues/18/comments","events_url":"https://api.github.com/repos/bitsofinfo/logstash-modsecurity/issues/18/events","html_url":"https://github.com/bitsofinfo/logstash-modsecurity/issues/18","id":117607923,"number":18,"title":"Modularize logstash-modsecurity config","user":{"login":"breml","id":6205217,"avatar_url":"https://avatars.githubusercontent.com/u/6205217?v=3","gravatar_id":"","url":"https://api.github.com/users/breml","html_url":"https://github.com/breml","followers_url":"https://api.github.com/users/breml/followers","following_url":"https://api.github.com/users/breml/following{/other_user}","gists_url":"https://api.github.com/users/breml/gists{/gist_id}","starred_url":"https://api.github.com/users/breml/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/breml/subscriptions","organizations_url":"https://api.github.com/users/breml/orgs","repos_url":"https://api.github.com/users/breml/repos","events_url":"https://api.github.com/users/breml/events{/privacy}","received_events_url":"https://api.github.com/users/breml/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":9,"created_at":"2015-11-18T15:13:49Z","updated_at":"2015-11-25T15:02:57Z","closed_at":null,"body":"We did some tests with your modsecurity configuration for logstash and we really *like it*. Thank you!\r\nNow we want to move a step forward and use this configuration in production. One problem we are facing is the following:\r\n\r\nWe have to apply some changes to the provided configuration, for example we want to remove the optional parts like \"X-Forwarded-For\" and \"Cookie\" and we plan to add some additional filters. At the same time we would love to stay compatible to the upstream configuration provided in this git repository. Therefore I would like to suggest a modularization of the provided configuration.\r\n\r\nBefore putting actual work into this proposal, I would like to know what you are thinking about this idea.\r\n\r\nMy suggestion is the following:\r\n\r\nLogstash does allow to load the configuration from a directory, where the files are concatenated in lexicographical order.\r\nIf the logstash-modsecurity configuration is modularized into several files, it would become easy to select those parts, we want to use and omit the others, like cherry-picking.\r\nThis allows to have the logstash-modsecurity repository for example in /etc/logstash/logstash/modsecurty and then simply make symlinks to /etc/logstash/config.d where our logstash installation will look for the actual configuration.\r\nTo preserve the correct order, the modularized config parts and the respective symlinks could be prefixed with a number.\r\n\r\nE. g. \r\n* 001_input_file.conf\r\n* 100_filter_split_sections.conf\r\n* 110_filter_section_a.conf\r\n* 120_filter_section_b.conf\r\n\r\nEvery part of the filter should be placed in a separate file an be surrounded by `filter { ... }`. \r\n\r\nThis way we are free select the filters we want to use from logstash-modsecurity and to insert own filters between and after the existing ones.\r\n\r\n\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/bitsofinfo/logstash-modsecurity/issues/comments/159634188","html_url":"https://github.com/bitsofinfo/logstash-modsecurity/issues/18#issuecomment-159634188","issue_url":"https://api.github.com/repos/bitsofinfo/logstash-modsecurity/issues/18","id":159634188,"user":{"login":"bitsofinfo","id":1743646,"avatar_url":"https://avatars.githubusercontent.com/u/1743646?v=3","gravatar_id":"","url":"https://api.github.com/users/bitsofinfo","html_url":"https://github.com/bitsofinfo","followers_url":"https://api.github.com/users/bitsofinfo/followers","following_url":"https://api.github.com/users/bitsofinfo/following{/other_user}","gists_url":"https://api.github.com/users/bitsofinfo/gists{/gist_id}","starred_url":"https://api.github.com/users/bitsofinfo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bitsofinfo/subscriptions","organizations_url":"https://api.github.com/users/bitsofinfo/orgs","repos_url":"https://api.github.com/users/bitsofinfo/repos","events_url":"https://api.github.com/users/bitsofinfo/events{/privacy}","received_events_url":"https://api.github.com/users/bitsofinfo/received_events","type":"User","site_admin":false},"created_at":"2015-11-25T15:02:57Z","updated_at":"2015-11-25T15:02:57Z","body":"Agree, please eliminate the patterns dir, that is something I did a long while back, and never got rid of it. That pattern can just be moved to it directly inline."}}