input {
  beats {
    port => 5044
    # no codec multiline here unless Filebeat is not doing it,
    # but better to do multiline in Filebeat
  }
}

filter {
  grok {
    match => {
      "message" => "^ModSecurity:\s*%{GREEDYDATA:modsec_message}\s*(?:\[(?<rest>.*)\])$"
    }
    tag_on_failure => ["grok_prefix_failed"]
  }

  if "_grokparsefailure" not in [tags] and [rest] {
    kv {
      source => "rest"
      field_split => "] ["
      value_split => " "
      trim_key => " \t"
      trim_value => "\""
      include_brackets => false
      value_split_pattern => " "
    }
  }
}

output {
  elasticsearch {
    hosts => ["http://localhost:9200"]
    index => "modsecurity-%{+YYYY.MM.dd}"
  }
  stdout { codec => rubydebug }
}

May 22 16:53:40 debian systemd[1]: Started logstash.service - logstash.
May 22 16:53:40 debian logstash[10659]: Using bundled JDK: /usr/share/logstash/jdk
May 22 16:53:58 debian logstash[10659]: Sending Logstash logs to /var/log/logstash which is now configured via log4j2.properties
May 22 16:53:58 debian logstash[10659]: [2025-05-22T16:53:58,521][INFO ][logstash.runner          ] Log4j configuration path used is: /etc/logstash/log4j2.properties
May 22 16:53:58 debian logstash[10659]: [2025-05-22T16:53:58,529][INFO ][logstash.runner          ] Starting Logstash {"logstash.version"=>"9.0.0", "jruby.version"=>"jruby 9.4.9.0 (3.1.4) 2024-11-04 547c6b150e OpenJDK 64-Bit Server VM 21.0.6+7-LTS on 21.0.6+7-LTS +indy +jit [x86_64-linux]"}
May 22 16:53:58 debian logstash[10659]: [2025-05-22T16:53:58,533][INFO ][logstash.runner          ] JVM bootstrap flags: [-Xms1g, -Xmx1g, -Djava.awt.headless=true, -Dfile.encoding=UTF-8, -Djruby.compile.invokedynamic=true, -XX:+HeapDumpOnOutOfMemoryError, -Djava.security.egd=file:/dev/urandom, -Dlog4j2.isThreadContextMapInheritable=true, -Djruby.regexp.interruptible=true, -Djdk.io.File.enableADS=true, --add-exports=jdk.compiler/com.sun.tools.javac.api=ALL-UNNAMED, --add-exports=jdk.compiler/com.sun.tools.javac.file=ALL-UNNAMED, --add-exports=jdk.compiler/com.sun.tools.javac.parser=ALL-UNNAMED, --add-exports=jdk.compiler/com.sun.tools.javac.tree=ALL-UNNAMED, --add-exports=jdk.compiler/com.sun.tools.javac.util=ALL-UNNAMED, --add-opens=java.base/java.security=ALL-UNNAMED, --add-opens=java.base/java.io=ALL-UNNAMED, --add-opens=java.base/java.nio.channels=ALL-UNNAMED, --add-opens=java.base/sun.nio.ch=ALL-UNNAMED, --add-opens=java.management/sun.management=ALL-UNNAMED, -Dio.netty.allocator.maxOrder=11]
May 22 16:53:58 debian logstash[10659]: [2025-05-22T16:53:58,588][INFO ][org.logstash.jackson.StreamReadConstraintsUtil] Jackson default value override `logstash.jackson.stream-read-constraints.max-string-length` configured to `200000000` (logstash default)
May 22 16:53:58 debian logstash[10659]: [2025-05-22T16:53:58,588][INFO ][org.logstash.jackson.StreamReadConstraintsUtil] Jackson default value override `logstash.jackson.stream-read-constraints.max-number-length` configured to `10000` (logstash default)
May 22 16:53:58 debian logstash[10659]: [2025-05-22T16:53:58,588][INFO ][org.logstash.jackson.StreamReadConstraintsUtil] Jackson default value override `logstash.jackson.stream-read-constraints.max-nesting-depth` configured to `1000` (logstash default)
May 22 16:53:59 debian logstash[10659]: [2025-05-22T16:53:59,794][INFO ][logstash.agent           ] Successfully started Logstash API endpoint {:port=>9600, :ssl_enabled=>false}
May 22 16:54:00 debian logstash[10659]: [2025-05-22T16:54:00,587][INFO ][org.reflections.Reflections] Reflections took 157 ms to scan 1 urls, producing 149 keys and 521 values
May 22 16:54:01 debian logstash[10659]: [2025-05-22T16:54:01,385][INFO ][logstash.javapipeline    ] Pipeline `main` is configured with `pipeline.ecs_compatibility: v8` setting. All plugins in this pipeline will default to `ecs_compatibility => v8` unless explicitly configured otherwise.
May 22 16:54:01 debian logstash[10659]: [2025-05-22T16:54:01,419][INFO ][logstash.outputs.elasticsearch][main] New Elasticsearch output {:class=>"LogStash::Outputs::ElasticSearch", :hosts=>["http://localhost:9200"]}
May 22 16:54:01 debian logstash[10659]: [2025-05-22T16:54:01,547][INFO ][logstash.outputs.elasticsearch][main] Elasticsearch pool URLs updated {:changes=>{:removed=>[], :added=>[http://localhost:9200/]}}
May 22 16:54:01 debian logstash[10659]: [2025-05-22T16:54:01,672][WARN ][logstash.outputs.elasticsearch][main] Restored connection to ES instance {:url=>"http://localhost:9200/"}
May 22 16:54:01 debian logstash[10659]: [2025-05-22T16:54:01,673][INFO ][logstash.outputs.elasticsearch][main] Elasticsearch version determined (9.0.0) {:es_version=>9}
May 22 16:54:01 debian logstash[10659]: [2025-05-22T16:54:01,690][INFO ][logstash.outputs.elasticsearch][main] Not eligible for data streams because config contains one or more settings that are not compatible with data streams: {"index"=>"modsecurity-%{+YYYY.MM.dd}"}
May 22 16:54:01 debian logstash[10659]: [2025-05-22T16:54:01,692][INFO ][logstash.outputs.elasticsearch][main] Data streams auto configuration (`data_stream => auto` or unset) resolved to `false`
May 22 16:54:01 debian logstash[10659]: /usr/share/logstash/vendor/bundle/jruby/3.1.0/gems/logstash-filter-kv-4.7.0/lib/logstash/filters/kv.rb:389: warning: character class has ']' without escape
May 22 16:54:01 debian logstash[10659]: [2025-05-22T16:54:01,699][ERROR][logstash.javapipeline    ][main] Pipeline error {:pipeline_id=>"main", :exception=>#<RegexpError: empty char-class: /[] []/>, :backtrace=>["org/jruby/RubyRegexp.java:914:in `initialize'", "org/jruby/RubyClass.java:922:in `new'", "/usr/share/logstash/vendor/bundle/jruby/3.1.0/gems/logstash-filter-kv-4.7.0/lib/logstash/filters/kv.rb:389:in `register'", "/usr/share/logstash/vendor/bundle/jruby/3.1.0/gems/logstash-mixin-ecs_compatibility_support-1.3.0-java/lib/logstash/plugin_mixins/ecs_compatibility_support/target_check.rb:48:in `register'", "org/logstash/config/ir/compiler/AbstractFilterDelegatorExt.java:75:in `register'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:245:in `block in register_plugins'", "org/jruby/RubyArray.java:1981:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:244:in `register_plugins'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:623:in `maybe_setup_out_plugins'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:257:in `start_workers'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:198:in `run'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:150:in `block in start'"], "pipeline.sources"=>["/etc/logstash/conf.d/modsecurity.conf"], :thread=>"#<Thread:0x5c1845fe /usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:138 run>"}
May 22 16:54:01 debian logstash[10659]: [2025-05-22T16:54:01,700][INFO ][logstash.javapipeline    ][main] Pipeline terminated {"pipeline.id"=>"main"}
May 22 16:54:01 debian logstash[10659]: [2025-05-22T16:54:01,706][INFO ][logstash.outputs.elasticsearch][main] Using a default mapping template {:es_version=>9, :ecs_compatibility=>:v8}
May 22 16:54:01 debian logstash[10659]: [2025-05-22T16:54:01,713][ERROR][logstash.agent           ] Failed to execute action {:id=>:main, :action_type=>LogStash::ConvergeResult::FailedAction, :message=>"Could not execute action: PipelineAction::Create<main>, action_result: false", :backtrace=>nil}
May 22 16:54:01 debian logstash[10659]: [2025-05-22T16:54:01,735][INFO ][logstash.runner          ] Logstash shut down.
May 22 16:54:01 debian logstash[10659]: [2025-05-22T16:54:01,758][INFO ][logstash.outputs.elasticsearch][main] Failed to perform request {:message=>"Connection pool shut down", :exception=>Manticore::ClientStoppedException, :cause=>#<Java::JavaLang::IllegalStateException: Connection pool shut down>}
May 22 16:54:01 debian logstash[10659]: [2025-05-22T16:54:01,763][ERROR][logstash.outputs.elasticsearch][main] Failed to install template {:message=>"Mutex relocking by same thread", :exception=>ThreadError, :backtrace=>["org/jruby/ext/thread/Mutex.java:101:in `lock'", "org/jruby/ext/thread/Mutex.java:172:in `synchronize'", "/usr/share/logstash/vendor/bundle/jruby/3.1.0/gems/logstash-output-elasticsearch-12.0.2-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:486:in `return_connection'", "/usr/share/logstash/vendor/bundle/jruby/3.1.0/gems/logstash-output-elasticsearch-12.0.2-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:434:in `with_connection'", "/usr/share/logstash/vendor/bundle/jruby/3.1.0/gems/logstash-output-elasticsearch-12.0.2-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:335:in `perform_request'", "/usr/share/logstash/vendor/bundle/jruby/3.1.0/gems/logstash-output-elasticsearch-12.0.2-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:343:in `block in Pool'", "/usr/share/logstash/vendor/bundle/jruby/3.1.0/gems/logstash-output-elasticsearch-12.0.2-java/lib/logstash/outputs/elasticsearch/http_client.rb:410:in `exists?'", "/usr/share/logstash/vendor/bundle/jruby/3.1.0/gems/logstash-output-elasticsearch-12.0.2-java/lib/logstash/outputs/elasticsearch/http_client.rb:418:in `template_exists?'", "/usr/share/logstash/vendor/bundle/jruby/3.1.0/gems/logstash-output-elasticsearch-12.0.2-java/lib/logstash/outputs/elasticsearch/http_client.rb:82:in `template_install'", "/usr/share/logstash/vendor/bundle/jruby/3.1.0/gems/logstash-output-elasticsearch-12.0.2-java/lib/logstash/outputs/elasticsearch/template_manager.rb:44:in `install'", "/usr/share/logstash/vendor/bundle/jruby/3.1.0/gems/logstash-output-elasticsearch-12.0.2-java/lib/logstash/outputs/elasticsearch/template_manager.rb:32:in `install_template'", "/usr/share/logstash/vendor/bundle/jruby/3.1.0/gems/logstash-output-elasticsearch-12.0.2-java/lib/logstash/outputs/elasticsearch.rb:627:in `install_template'", "/usr/share/logstash/vendor/bundle/jruby/3.1.0/gems/logstash-output-elasticsearch-12.0.2-java/lib/logstash/outputs/elasticsearch.rb:346:in `finish_register'", "/usr/share/logstash/vendor/bundle/jruby/3.1.0/gems/logstash-output-elasticsearch-12.0.2-java/lib/logstash/outputs/elasticsearch.rb:303:in `block in register'", "/usr/share/logstash/vendor/bundle/jruby/3.1.0/gems/logstash-output-elasticsearch-12.0.2-java/lib/logstash/plugin_mixins/elasticsearch/common.rb:172:in `block in after_successful_connection'"]}
May 22 16:54:01 debian logstash[10659]: [2025-05-22T16:54:01,766][FATAL][org.logstash.Logstash    ] Logstash stopped processing because of an error: (SystemExit) exit
May 22 16:54:01 debian logstash[10659]: org.jruby.exceptions.SystemExit: (SystemExit) exit
May 22 16:54:01 debian logstash[10659]:         at org.jruby.RubyKernel.exit(org/jruby/RubyKernel.java:924) ~[jruby.jar:?]
May 22 16:54:01 debian logstash[10659]:         at org.jruby.RubyKernel.exit(org/jruby/RubyKernel.java:883) ~[jruby.jar:?]
May 22 16:54:01 debian logstash[10659]:         at usr.share.logstash.lib.bootstrap.environment.<main>(/usr/share/logstash/lib/bootstrap/environment.rb:90) ~[?:?]