Mar 11, 2024 @ 10:47:45.429

- @timestamp, column 3, row 1
ERROR
[Mon Mar 11 09:47:45 2024] [debug] proxy_util.c(2596): [client 10.0.0.2:58392] AH00947: connected /pex-inventory/ws/v2/user/?code=SCW0118006&codlng=0&perimeterid=115dcde1-6899-42b7-a859-a7882018a9ce to uat-rpwa-pex-inter.sfs-qualif.caas-cnp-apps-v2.com.intraorange:443, referer https://www.espace-client.exploit-ip-uat.orange-business.com/pex-inventory/gui/v1/?code=SCW0118006&codlng=0&perimeterid=115dcde1-6899-42b7-a859-a7882018a9ce&context=indigo2&offerId=NUMEROS_CONTACT_IP
logs-sfs.error@custom: processors dissect in pipeline logs-sfs.error@custom failed with message Unable to find match for dissect pattern: [%{timestamp}] [%{log_level}] %{filename}(%{linenumber}): [%{client_ip}] [%{ignored_message}] %{restOfLine} against source: [Mon Mar 11 09:47:45 2024] [debug] proxy_util.c(2596): [client 10.0.0.2:58392] AH00947: connected /pex-inventory/ws/v2/user/?code=SCW0118006&codlng=0&perimeterid=115dcde1-6899-42b7-a859-a7882018a9ce to uat-rpwa-pex-inter.sfs-qualif.caas-cnp-apps-v2.com.intraorange:443, referer https://www.espace-client.exploit-ip-uat.orange-business.com/pex-inventory/gui/v1/?code=SCW0118006&codlng=0&perimeterid=115dcde1-6899-42b7-a859-a7882018a9ce&context=indigo2&offerId=NUMEROS_CONTACT_IP
Mar 11, 2024 @ 10:47:45.428
ERROR
[Mon Mar 11 09:47:45 2024] [debug] ssl_engine_kernel.c(2069): [client 10.235.70.188:443] AH02041: Protocol: TLSv1.2, Cipher: ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)
logs-sfs.error@custom: processors dissect in pipeline logs-sfs.error@custom failed with message Unable to find match for dissect pattern: [%{timestamp}] [%{log_level}] %{filename}(%{linenumber}): [%{client_ip}] [%{ignored_message}] %{restOfLine} against source: [Mon Mar 11 09:47:45 2024] [debug] ssl_engine_kernel.c(2069): [client 10.235.70.188:443] AH02041: Protocol: TLSv1.2, Cipher: ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)
Mar 11, 2024 @ 10:47:45.424
ERROR
[Mon Mar 11 09:47:45 2024] [debug] ssl_engine_kernel.c(1584): [client 10.235.70.188:443] AH02275: Certificate Verification, depth 0, CRL checking mode: none (0) [subject: <PRESIDIO_ANONYMIZED_EMAIL_ADDRESS>,CN=.sfs-qualif.caas-cnp-apps-v2.com.intraorange,OU=Orange Business Services,O=Orange,L=Paris,ST=Paris,C=FR / issuer: CN=Orange Internal G2 Server CA,OU=FR 89 380129866,O=Orange,C=FR / serial: 39E5400000BE3547743EEABB89BF15AD9365A9EA / notbefore: Apr 4 16:03:28 2023 GMT / notafter: Apr 4 16:03:28 2025 GMT]
logs-sfs.error@custom: processors dissect in pipeline logs-sfs.error@custom failed with message Unable to find match for dissect pattern: [%{timestamp}] [%{log_level}] %{filename}(%{linenumber}): [%{client_ip}] [%{ignored_message}] %{restOfLine} against source: [Mon Mar 11 09:47:45 2024] [debug] ssl_engine_kernel.c(1584): [client 10.235.70.188:443] AH02275: Certificate Verification, depth 0, CRL checking mode: none (0) [subject: <PRESIDIO_ANONYMIZED_EMAIL_ADDRESS>,CN=.sfs-qualif.caas-cnp-apps-v2.com.intraorange,OU=Orange Business Services,O=Orange,L=Paris,ST=Paris,C=FR / issuer: CN=Orange Internal G2 Server CA,OU=FR 89 380129866,O=Orange,C=FR / serial: 39E5400000BE3547743EEABB89BF15AD9365A9EA / notbefore: Apr 4 16:03:28 2023 GMT / notafter: Apr 4 16:03:28 2025 GMT]
Mar 11, 2024 @ 10:47:45.424
ERROR
[Mon Mar 11 09:47:45 2024] [debug] ssl_engine_kernel.c(1584): [client 10.235.70.188:443] AH02275: Certificate Verification, depth 0, CRL checking mode: none (0) [subject: <PRESIDIO_ANONYMIZED_EMAIL_ADDRESS>,CN=.sfs-qualif.caas-cnp-apps-v2.com.intraorange,OU=Orange Business Services,O=Orange,L=Paris,ST=Paris,C=FR / issuer: CN=Orange Internal G2 Server CA,OU=FR 89 380129866,O=Orange,C=FR / serial: 39E5400000BE3547743EEABB89BF15AD9365A9EA / notbefore: Apr 4 16:03:28 2023 GMT / notafter: Apr 4 16:03:28 2025 GMT]
logs-sfs.error@custom: processors dissect in pipeline logs-sfs.error@custom failed with message Unable to find match for dissect pattern: [%{timestamp}] [%{log_level}] %{filename}(%{linenumber}): [%{client_ip}] [%{ignored_message}] %{restOfLine} against source: [Mon Mar 11 09:47:45 2024] [debug] ssl_engine_kernel.c(1584): [client 10.235.70.188:443] AH02275: Certificate Verification, depth 0, CRL checking mode: none (0) [subject: <PRESIDIO_ANONYMIZED_EMAIL_ADDRESS>,CN=.sfs-qualif.caas-cnp-apps-v2.com.intraorange,OU=Orange Business Services,O=Orange,L=Paris,ST=Paris,C=FR / issuer: CN=Orange Internal G2 Server CA,OU=FR 89 380129866,O=Orange,C=FR / serial: 39E5400000BE3547743EEABB89BF15AD9365A9EA / notbefore: Apr 4 16:03:28 2023 GMT / notafter: Apr 4 16:03:28 2025 GMT]
Mar 11, 2024 @ 10:47:45.419
ERROR
[Mon Mar 11 09:47:45 2024] [debug] mod_proxy.c(1265): [client 10.0.0.2:58392] AH01143: Running scheme https handler (attempt 0), referer https://www.espace-client.exploit-ip-uat.orange-business.com/pex-inventory/gui/v1/?code=SCW0118006&codlng=0&perimeterid=115dcde1-6899-42b7-a859-a7882018a9ce&context=indigo2&offerId=NUMEROS_CONTACT_IP
logs-sfs.error@custom: processors dissect in pipeline logs-sfs.error@custom failed with message Unable to find match for dissect pattern: [%{timestamp}] [%{log_level}] %{filename}(%{linenumber}): [%{client_ip}] [%{ignored_message}] %{restOfLine} against source: [Mon Mar 11 09:47:45 2024] [debug] mod_proxy.c(1265): [client 10.0.0.2:58392] AH01143: Running scheme https handler (attempt 0), referer https://www.espace-client.exploit-ip-uat.orange-business.com/pex-inventory/gui/v1/?code=SCW0118006&codlng=0&perimeterid=115dcde1-6899-42b7-a859-a7882018a9ce&context=indigo2&offerId=NUMEROS_CONTACT_IP
Mar 11, 2024 @ 10:47:45.419
ERROR
[Mon Mar 11 09:47:45 2024] [debug] proxy_util.c(2331): AH00942: HTTPS: has acquired connection for ()
logs-sfs.error@custom: processors dissect in pipeline logs-sfs.error@custom failed with message Unable to find match for dissect pattern: [%{timestamp}] [%{log_level}] %{filename}(%{linenumber}): [%{client_ip}] [%{ignored_message}] %{restOfLine} against source: [Mon Mar 11 09:47:45 2024] [debug] proxy_util.c(2331): AH00942: HTTPS: has acquired connection for ()
Mar 11, 2024 @ 10:47:45.419
ERROR
[Mon Mar 11 09:47:45 2024] [debug] proxy_util.c(2384): [client 10.0.0.2:58392] AH00944: connecting https://uat-rpwa-pex-inter.sfs-qualif.caas-cnp-apps-v2.com.intraorange/pex-inventory/ws/v2/user/?code=SCW0118006&codlng=0&perimeterid=115dcde1-6899-42b7-a859-a7882018a9ce to uat-rpwa-pex-inter.sfs-qualif.caas-cnp-apps-v2.com.intraorange:443, referer https://www.espace-client.exploit-ip-uat.orange-business.com/pex-inventory/gui/v1/?code=SCW0118006&codlng=0&perimeterid=115dcde1-6899-42b7-a859-a7882018a9ce&context=indigo2&offerId=NUMEROS_CONTACT_IP
logs-sfs.error@custom: processors dissect in pipeline logs-sfs.error@custom failed with message Unable to find match for dissect pattern: [%{timestamp}] [%{log_level}] %{filename}(%{linenumber}): [%{client_ip}] [%{ignored_message}] %{restOfLine} against source: [Mon Mar 11 09:47:45 2024] [debug] proxy_util.c(2384): [client 10.0.0.2:58392] AH00944: connecting https://uat-rpwa-pex-inter.sfs-qualif.caas-cnp-apps-v2.com.intraorange/pex-inventory/ws/v2/user/?code=SCW0118006&codlng=0&perimeterid=115dcde1-6899-42b7-a859-a7882018a9ce to uat-rpwa-pex-inter.sfs-qualif.caas-cnp-apps-v2.com.intraorange:443, referer https://www.espace-client.exploit-ip-uat.orange-business.com/pex-inventory/gui/v1/?code=SCW0118006&codlng=0&perimeterid=115dcde1-6899-42b7-a859-a7882018a9ce&context=indigo2&offerId=NUMEROS_CONTACT_IP
Mar 11, 2024 @ 10:47:45.418
ERROR
[Mon Mar 11 09:47:45 2024] [debug] proxy_util.c(3066): AH02824: HTTPS: connection established with 10.235.70.188:443 ()
logs-sfs.error@custom: processors dissect in pipeline logs-sfs.error@custom failed with message Unable to find match for dissect pattern: [%{timestamp}] [%{log_level}] %{filename}(%{linenumber}): [%{client_ip}] [%{ignored_message}] %{restOfLine} against source: [Mon Mar 11 09:47:45 2024] [debug] proxy_util.c(3066): AH02824: HTTPS: connection established with 10.235.70.188:443 ()
Mar 11, 2024 @ 10:47:45.418
ERROR
[Mon Mar 11 09:47:45 2024] [debug] proxy_util.c(3234): AH00962: HTTPS: connection complete to 10.235.70.188:443 (uat-rpwa-pex-inter.sfs-qualif.caas-cnp-apps-v2.com.intraorange)
logs-sfs.error@custom: processors dissect in pipeline logs-sfs.error@custom failed with message Unable to find match for dissect pattern: [%{timestamp}] [%{log_level}] %{filename}(%{linenumber}): [%{client_ip}] [%{ignored_message}] %{restOfLine} against source: [Mon Mar 11 09:47:45 2024] [debug] proxy_util.c(3234): AH00962: HTTPS: connection complete to 10.235.70.188:443 (uat-rpwa-pex-inter.sfs-qualif.caas-cnp-apps-v2.com.intraorange)
Mar 11, 2024 @ 10:47:45.418
ERROR
[Mon Mar 11 09:47:45 2024] [info] [client 10.235.70.188:443] AH01964: Connection to child 0 established (server SFS-RP:80)
logs-sfs.error@custom: processors dissect in pipeline logs-sfs.error@custom failed with message Unable to find match for dissect pattern: [%{timestamp}] [%{log_level}] %{filename}(%{linenumber}): [%{client_ip}] [%{ignored_message}] %{restOfLine} against source: [Mon Mar 11 09:47:45 2024] [info] [client 10.235.70.188:443] AH01964: Connection to child 0 established (server SFS-RP:80)



ma pipeline :
[
{
“dissect”: {
“field”: “event.original”,
“pattern”: ““APACHE-%{event.type}-%{service.id}-%{+service.id}-%{+service.id}-%{+service.id}-%{+service.id}-%{service.version}”%{message}”
}
},
{
“dissect”: {
“field”: “message”,
“pattern”: “[%{timestamp}] [%{log_level}] %{filename}(%{linenumber}): [%{client_ip}] [%{ignored_message}] %{restOfLine}”
}
},
{
“grok”: {
“field”: “restOfLine”,
“patterns”: [
“\[%{DATA:client_ip}\] %{DATA:action} %{GREEDYDATA:additional_info}”
]
}
},
{
“grok”: {
“field”: “additional_info”,
“patterns”: [
“to %{IP:destination_ip}:%{POSINT:destination_port}”,
“depth %{INT:ssl_depth}, CRL checking mode: %{DATA:crl_mode} \[subject: %{GREEDYDATA:certificate_subject} / issuer: %{GREEDYDATA:certificate_issuer} / serial: %{DATA:certificate_serial} / notbefore: %{DATA:certificate_notbefore} / notafter: %{DATA:certificate_notafter}\]”,
“Protocol: %{DATA:protocol}, Cipher: %{DATA:cipher} \(%{NUMBER:bits}/%{NUMBER:bits_max} bits\)”
]
}
},
{
“date”: {
“field”: “timestamp”,
“target_field”: “@timestamp”,
“formats”: [
“EEE MMM dd HH:mm:ss yyyy”
]
}
}
]
[
{
“set”: {
“field”: “error.message”,
“value”: “{{_ingest.pipeline}}: processors {{_ingest.on_failure_processor_type}} in pipeline {{_ingest.on_failure_pipeline}} failed with message {{_ingest.on_failure_message}}”
}
}
]


the first dissect is there to dissect the full log in event.original that start like this “APACHE-ERROR-SFS-RPXD-MSS-MSS-UAT-G03R04C12”, but i block startin the date