logstash.conf

input {
  stdin {}
}
filter {
  csv {
    skip_header => true
    columns => ["date","source","remark","location", "region", "ocpac_marking"]
    remove_field => ["message", "host"]
  }
  mutate {
    gsub => [
      "location", "[\[\]]", ""
    ]
    split => {
      "ocpac_marking" => "//"
      "location" => ","
    }
  }
  ruby {
    code => "
      #clean up space before the latitude resulting from the previous comma split
      originalLocation = event.get('location')
      location = []
      location << originalLocation[0].to_f
      location << originalLocation[1].strip.to_f
      event.set('location', location)

      #break out all the components of the ocpac marking into their own fields
      #we also want to set nils to empty lists to greatly simplify our ABAC logic
      ocpac = event.get('ocpac_marking')
      compartments = []
      dissemination = []
      if ocpac.length == 3 #for level//compartments//dissem
          compartments = ocpac[1].split('/')
          dissemination = ocpac[2]
      elsif ocpac.length == 2 
          if ['NROFON','OUOF','EYEEVIF'].include? ocpac[1] 
              compartments = ['NONE']
              dissemination = ocpac[1]
          else 
              compartments = ocpac[1].split('/')
              dissemination = ['NONE']
          end
      end
      event.set('security_level', ocpac[0])
      event.set('security_compartments', compartments)
      event.set('security_compartments_min', compartments.count)
      event.set('security_dissemination', dissemination)
    "
    remove_field => ["ocpac_marking"]
  }
}
output {
  elasticsearch {
    hosts => "http://localhost:9200/"
    index => "elasticon-dc-2018"
    user => "elastic"
    password => "changeme"
  }
#  stdout {
#    codec => "rubydebug"
#  }
}