2110_filter_section_k_parse_matchedRules.conf

filter {
  if [type] == "mod_security" {

    #~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    # Convert section K into an array
    # and rename it to "matchedRules"
    # also create an array of just the
    # secRuleIds that were located in
    # sectionK
    #~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    if [rawSectionK] =~ /.+/ {

      # hack.. @see https://logstash.jira.com/browse/LOGSTASH-1331
      mutate {
        gsub => [ "rawSectionK", "\n", "~" ]
        gsub => [ "rawSectionK", "(~+)", "~" ]
        split => [ "rawSectionK" , "~" ]
      }

      mutate {
        rename => [ "rawSectionK", "matchedRules"]
      }

      ruby {
        code => "
            secRuleIds = Array.new()
            matchedRules_array = event.get('matchedRules')
            matchedRules_array.each do |entry|
              if entry.match(/^SecRule /) and entry.match(/,id:/)
                secRuleIds.push(/,id:(?<ruleId>\d+)/.match(entry)[:ruleId])
              end
            end
            event.set('secRuleIds', secRuleIds)
          "
      }
    }
  }
}