# Guy Bruneau, guybruneau@outlook.com
# Date: 6 Dec 2019
# Version: 0.5
#
# Updated: 20 Feb 2020
# Version: 0.6
#
# Changed to Elastic Common Schema (ECS) format
#
# This is a Pihole parser for the 3 different log format contained in Pihole
# The logs are located at: /var/log/pihole.log
input {
  beats {
    port => 5044
  }
}

# Dec  1 00:00:28 dnsmasq[1754]: reply googlehosted.l.googleusercontent.com is 172.217.13.129
# Dec  1 00:04:07 dnsmasq[1754]: reply outlook.ms-acdc.office.com is <CNAME>

filter {
   grok {
      match => { "message" => "^%{SYSLOGBASE2}%{SYSLOG5424PRINTASCII}%{POSINT:pid}\]:\s+%{WORD:dns.type}\s+%{GREEDYDATA:dns.question.name}\s+is\s+(%{IP:dns.resolved_ip})?(<?%{WORD:dns.answers.type}>|%{GREEDYDATA:dns.answers.type})?" }
   }
}

# Dec  1 00:00:03 dnsmasq[1754]: query[AAAA] f242323c-332f-4f4a-84ff-9aee076171ea.netwitness from 192.168.25.2
# Dec  1 00:00:26 dnsmasq[1754]: query[A] play.google.com from 192.168.25.2
# Dec  1 00:00:33 dnsmasq[1754]: query[MX] seeker.d2g.ca from 192.168.25.2

filter {
   grok {
      match => { "message" => "^%{SYSLOGBASE2}%{SYSLOG5424PRINTASCII}%{POSINT:pid}\]:\s+%{WORD:dns.type}\[%{WORD:dns.question.type}\]\s+%{GREEDYDATA:dns.question.name}\s+from\s+%{IP:source.ip}" }
   }
}

# Dec  1 00:00:01 dnsmasq[1754]: /etc/pihole/regex.list ns2.bta.net.ca is 0.0.0.0
# Dec  1 20:00:47 dnsmasq[1754]: /etc/pihole/gravity.list mobile.pipe.aria.microsoft.com is 0.0.0.0

filter {
   grok {
      match => { "message" => "^%{SYSLOGBASE2}%{SYSLOG5424PRINTASCII}%{POSINT:pid}\]:\s+\/etc\/pihole\/%{DATA:dns.type}\s+%{GREEDYDATA:dns.question.name}\s+is\s+%{IP:dns.resolved_ip}" }
   }
}

# Dec  1 00:00:07 dnsmasq[1754]: forwarded api-global.us-east-1.prodaa.netflix.com to 8.8.8.8
# Dec  1 00:00:03 dnsmasq[1754]: forwarded f242323c-332f-4f4a-84ff-9aee076171ea.go to 8.8.8.8

filter {
   grok {
      match => { "message" => "^%{SYSLOGBASE2}%{SYSLOG5424PRINTASCII}%{POSINT:pid}\]:\s+%{WORD:dns.type}\s+%{GREEDYDATA:dns.question.name}\s+to\s+%{IP:destination.ip}" }
   }
}

filter {
   geoip {
      source => "dns.resolved_ip"
      }
   geoip {
      source => "destination.ip"
      }
}


output {
  elasticsearch {
    hosts => ["192.168.25.14:9200"]
    index => "pihole-%{+YYYY.MM.dd}"
    #index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
    #user => "elastic"
    #password => "changeme"
  }
#  stdout { codec => rubydebug { metadata => true } }
}
