Unifi 記錄傳到 Graylog

官方的套件庫是有人提供，但是需要手動去設定

設定方式如下：

首先到 rsyslog 設定檔新增新的接收的 port 號

vim /etc/rsyslog.conf

在最後一行新增加下面的語法
*.* @127.0.0.1:5514;RSYSLOG_SyslogProtocol23Format

新增完之後存檔離開重啟服務

systemctl restart rsyslog

進到 graylog 設定服務 system 下的 inputs

新增加 syslog UDP 服務接收

到 streams 新增規則

輸入 Ubiquity Access Point logs 然後存檔

加入則規

新增則規

填寫內容如下

Field：message

Type：match regular expression

Value：^.+,(.+?),.+? (.+?): (.+)$

選擇 system >> pipelines

新增管道

新增項目

建立規則

規則內容如下

rule "parse any MAC address out of message field"
when
  has_field("message")
then
  let m = regex("([0-9A-Fa-f]{2}:[0-9A-Fa-f]{2}:[0-9A-Fa-f]{2}:[0-9A-Fa-f]{2}:[0-9A-Fa-f]{2}:[0-9A-Fa-f]{2})", to_string($message.message));
  
  // It's NULL if there was no match and will simply not be set internally by Graylog.
  set_field("mac_address", m["0"]);
end

rule "parse Ubiquiti access point logs"
when
has_field("message")
then
let m = regex("^(.+),(.+?),(.+?): hostapd: (.+?): (.+?) (.+?) (.+): (.+)$", to_string($message.message));

let sname = m["0"];
let lookupsource = m["1"];
let version = m["2"];
let bssid = m["5"];
let subsystem = m["6"];
let action = m["7"];
//let clean_message = m["2"];

// Build a better source name
//set_field("source", concat("ap-", to_string(bssid)));

// Set additional fields.
set_field("type", "ubiquity-ap");
set_field("bssid", bssid);
set_field("subsystem", subsystem);
set_field("version",version);
set_field("sname", sname);
set_field("action", action);

let lookupsource = lookup("ubnt_lookup",lookupsource);
set_field("source",lookupsource);

// Set a better message field without the prefix clutter.
//set_field("message", clean_message);
end