filter {

if [type] == "mod_security" {

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

# Due to the complexity of the collapsed single string

# we get from multiline and the variance of exactly

# which modsec sections (A-K) may or may not be in each

# log entry, we run some custom ruby code that will

# split on each modsec "section" and store each found in

# new fields named "rawSection[A-K]" as appropriate, the value

# of each of these fields contains the raw un-parsed data

# from that modsec section. Sections that are non-existant

# will not have a key in "fields"

#

# A bit long and crazy yes, but after spending many hours

# just doing this w/ grok patterns, this ended up being the

# most reliable way to break up this in-consistent format into

# more usable blocks

#

# @see https://github.com/SpiderLabs/ModSecurity/wiki/ModSecurity-2-Data-Formats

#

# READ the above to get a good understanding of the sections

# and which ones can actively contain data depending on your modsec

# version and environment!

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

ruby {

code => "

if !event.get('message').nil?

modSecSectionData = event.get('message').split(/(?:--[a-fA-F0-9]{8}-([A-Z])--)/)

modSecSectionData.shift

for i in 0..((modSecSectionData.length-1)/2)

sectionName = 'rawSection'.concat(modSecSectionData.shift)

sectionData = modSecSectionData.shift

sectionName = sectionName.strip

if !sectionData.nil?

sectionData = sectionData.strip

end

event.set(sectionName, sectionData)

end

end

"

}

}

}