<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal">Hello, <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I’m really scratching my head trying to make this work and thought maybe the community has experienced this before. I’m collecting logs from Wazuh and Syslog-NG. Those logs are sent from my Wazuh server with Sylog-NG configured to send
to my MySQL server. The Syslog-ng.conf file on the MySQL server is configured with a destination to mysql.
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">In the declared the destination and list out columns and values.
<o:p></o:p></p>
<p class="MsoNormal"># MySQL define destination<o:p></o:p></p>
<p class="MsoNormal">destination d_mysql {<o:p></o:p></p>
<p class="MsoNormal">sql(<o:p></o:p></p>
<p class="MsoNormal">type(mysql)<o:p></o:p></p>
<p class="MsoNormal">username("syslog")<o:p></o:p></p>
<p class="MsoNormal">password("xxxxxxx")<o:p></o:p></p>
<p class="MsoNormal">database("syslog")<o:p></o:p></p>
<p class="MsoNormal">host("127.0.0.1")<o:p></o:p></p>
<p class="MsoNormal">table("logs")<o:p></o:p></p>
<p class="MsoNormal">columns("host", "id", "location", "facility", "rule", "priority", "level", "tag", "datetime", "program", "msg")<o:p></o:p></p>
<p class="MsoNormal">values("$HOST", "$ID", "$LOCATION","$FACILITY", "$RULE", "$PRIORITY", "$LEVEL", "$TAG","$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC","$PROGRAM", "$MSG")<o:p></o:p></p>
<p class="MsoNormal">indexes("datetime", "host", "id", "location", "rule")<o:p></o:p></p>
<p class="MsoNormal">);<o:p></o:p></p>
<p class="MsoNormal">};<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">So here’s the problem. The Message data contains information like Rule and Location that really equate to the Wazuh Rule and Location = the Wazuh Agent that’s reporting it. I had hoped “location” column would populate with the Location
date from the message. Same with Rule. <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">SO my question to the community is how on earth do I parse the data in the message field to populate columns (existing or new)? Any thoughts, guidance, recommendations are greatly appreciated.
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:black">Thanks,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:black"><br>
</span><span style="font-size:12.0pt;font-family:"Arial",sans-serif;color:black">Allen Olivas</span><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:black"><br>
</span><b><i><span style="font-size:18.0pt;font-family:"Arial",sans-serif;color:#3A67B8">Info</span></i></b><b><i><span style="font-size:18.0pt;font-family:"Arial",sans-serif;color:#5F5F5F">Defense</span></i></b><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:black"><br>
Office: (972) 848-7910<br>
Email: allen.olivas@infodefense.com<br>
Toll Free: (877) INFODEFENSE<br>
</span><a href="https://l.shatrk.com/r/e/DblvLSPvKY2IxMPE?r=https://app.salesforceiq.com/r?target=5c77291cc9e77c007aa6cb3e&t=AFwhZf0O7sC6c6N-x691ne-Q9q_27TNhu1ayis_kAJ00Z7HL-lH9bPLytoPohWYrCc5EpGO_mM--1dDX-GDgklCQ_2ZINq3F1wwLoCnz9aRhfWm9RG1fC4RVQcHYR5hMwHruEmd00J_U&url=http://www.infodefense.com/" title="http://www.infodefense.com/"><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:blue">www.infodefense.com</span></a><span style="font-size:13.5pt;font-family:"Times New Roman",serif;color:black"><br>
<br>
</span><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>