使用Logstash接收Netflow日志并发送到syslog服务器

接受90端口的netflow日志，解析netflow中的源IP、端口、目的IP、端口，并输出syslog到任意端口  

netflow日志格式：

{
       "netflow" => {
          "last_switched" => "2020-05-28T02:39:13.781Z",
                 "dst_as" => 0,
               "in_bytes" => 183,
          "ipv4_src_addr" => "120.92.11.28", #源IP
               "protocol" => 6,
          "ipv4_next_hop" => "172.16.10.10",
             "input_snmp" => 1,
                "version" => 9,
             "flowset_id" => 265,
                 "src_as" => 0,
              "tcp_flags" => 24,
         "first_switched" => "2020-05-28T02:39:13.781Z",
           "flow_seq_num" => 2488,
            "l4_src_port" => 7823,    # 源端口
            "output_snmp" => 2,
              "direction" => 0,
                "in_pkts" => 1,
          "ipv4_dst_addr" => "192.168.80.15", #目的IP
               "src_mask" => 0,
               "dst_mask" => 16,
        "flow_sampler_id" => 0,
                "src_tos" => 0,
            "l4_dst_port" => 53367  #目的端口
    },
          "host" => "88.88.88.88",
    "@timestamp" => 2020-05-28T02:39:37.000Z,
      "@version" => "1"
}
详细字段说明： https://www.ibm.com/support/knowledgecenter/en/SSCVHB_1.2.2/collector/cnpi_collector_v9_fiels_types.html
安装syslog输出插件 bin/logstash-plugin install logstash-output-syslog

input {
  udp {
    port  => 90
    codec => netflow
  }
}
filter{
  mutate {
    rename => { "[netflow][ipv4_src_addr]" => "src_ip"
    "[netflow][l4_src_port]"=> "src_port"
    "[netflow][ipv4_dst_addr]"=>"dst_ip"
    "[netflow][l4_dst_port]"=>"dst_port"
    }
    remove_field => ["netflow"]
  }
}
output {
#  stdout{
#    codec => rubydebug
#  }
  syslog {
    host => "192.168.100.123" 
    port => 16060
 }
}