Repository: cowrie/cowrie

Issue:
Update documentation on Cowrie with ELK
Some information in the [official documentation regarding integration with ELK](https://cowrie.readthedocs.io/en/latest/elk/README.html) is obsolete/wrong. 

In `kibana.yml`: the following suggested line is not accepted by Kibana 7.6.0 and prevents it from running.
`tilemap.url: https://tiles.elastic.co/v2/default/{z}/{x}/{y}.png?elastic_tile_service_tos=agree&my_app_name=kibana`

For **logstash**, it is no longer possible to get the GeoIP database directly from this link `wget http://geolite.maxmind.com/download/geoip/database/GeoLite2-City.mmdb.gz`: you must first register on [maxmind](https://www.maxmind.com), then get access to a download page and will get access to a GeoLite2.gzip file. This file must be unzipped to locate the mmdb file inside.

For **filebeat**, the custom configuration file `filebeat-cowrie.conf` no longer works with filebeat 7.6.0: you no longer must specify a "prospector" but a `filebeat.inputs`:

```
filebeat.inputs:
- type: log
  enabled: true
  paths:
    - /home/xxx/cowrie/var/log/cowrie/cowrie.json*
  encoding: plain
```


Discussion:
Other bug: in `./docs/elk/logstash-cowrie.conf`, the line `if [type] == "cowrie"` is incorrect and should be `if [fields][document_type] == "cowrie"` (see https://discuss.elastic.co/t/solved-cant-get-logstash-to-catch-cowrie-filebeat/165866/3).
>and should be if [fields][document_type] == "cowrie"

No, it shouldn't. `document_type` is deprecated in 6.x and removed in 7.x
It would be nice you can make up to date configs for 6.8.x and 7.x, since there are a lot of breaking changes between 6.x and 7.x. So it might take a lot of time & effort to move to 7.x if somebody already have indexes with cowrie's data.
> No, it shouldn't. document_type is deprecated in 6.x and removed in 7.x

@fe7ch well, what is certain is that `if [type] == "cowrie"` is incorrect for 7.6.0 and causes logstash to refuse to spawn. Using `if [fields][document_type] == "cowrie"` fixed the issue, although I am not able to say if it is the right way to do it.
@fe7ch you are right `[fields][document_type]` is probably incorrect. Actually, `[type]` is too, in the logs, I see the following message indicating that even `type` is obsolete in 7.6.0...

```
Mar 09 11:12:24 instance-39 logstash[12416]: [2020-03-09T11:12:24,830][WARN ][logstash.outputs.elasticsearch][main] Detected a 6.x and above cluster: the `type` event field won't be used to determine the document _type {:es_version=>7}
```

Trying to work out the correct configuration for 7.6.0...

Resolving patch:
diff --git a/src/cowrie/shell/honeypot.py b/src/cowrie/shell/honeypot.py
--- a/src/cowrie/shell/honeypot.py
+++ b/src/cowrie/shell/honeypot.py
@@ -13,6 +13,7 @@
 from twisted.python.compat import iterbytes
 
 from cowrie.shell import fs
+from cowrie.core.config import CowrieConfig
 
 # From Python3.6 we get the new shlex version
 if sys.version_info.major >= 3 and sys.version_info.minor >= 6:
@@ -296,21 +297,27 @@ def showPrompt(self):
         if not self.interactive:
             return
 
-        cwd = self.protocol.cwd
-        homelen = len(self.protocol.user.avatar.home)
-        if cwd == self.protocol.user.avatar.home:
-            cwd = '~'
-        elif len(cwd) > (homelen + 1) and \
-                cwd[:(homelen + 1)] == self.protocol.user.avatar.home + '/':
-            cwd = '~' + cwd[homelen:]
-
-        # Example: [root@svr03 ~]#   (More of a "CentOS" feel)
-        # Example: root@svr03:~#     (More of a "Debian" feel)
-        prompt = '{0}@{1}:{2}'.format(self.protocol.user.username, self.protocol.hostname, cwd)
-        if not self.protocol.user.uid:
-            prompt += '# '  # "Root" user
+        prompt = ''
+        if CowrieConfig().has_option('honeypot','prompt'):
+            prompt = CowrieConfig().get('honeypot', 'prompt')
+            prompt += ' '
+            
         else:
-            prompt += '$ '  # "Non-Root" user
+            cwd = self.protocol.cwd
+            homelen = len(self.protocol.user.avatar.home)
+            if cwd == self.protocol.user.avatar.home:
+                cwd = '~'
+            elif len(cwd) > (homelen + 1) and \
+                 cwd[:(homelen + 1)] == self.protocol.user.avatar.home + '/':
+                cwd = '~' + cwd[homelen:]
+
+            # Example: [root@svr03 ~]#   (More of a "CentOS" feel)
+            # Example: root@svr03:~#     (More of a "Debian" feel)
+            prompt = '{0}@{1}:{2}'.format(self.protocol.user.username, self.protocol.hostname, cwd)
+            if not self.protocol.user.uid:
+                prompt += '# '  # "Root" user
+            else:
+                prompt += '$ '  # "Non-Root" user
 
         self.protocol.terminal.write(prompt.encode('ascii'))
         self.protocol.ps = (prompt.encode('ascii'), b'> ')


Test patch: