unifi.conf

if "UniFiAP" in [tags] {
    grok {
      patterns_dir => [ "/etc/logstash/patterns" ]
      match => [
        "message", "%{SYSLOG5424PRI}%{CISCOTIMESTAMP:timestamp}%{UNIFI_DEV_TYPE} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{WORD:unifi_interface}: STA %{MAC:unifi_sta_mac} %{UNIFI_EVENT_TYPE:unifi_sta_event_type}: %{GREEDYDATA:unifi_sta_event}",
        "message", "%{SYSLOG5424PRI}%{CISCOTIMESTAMP:timestamp}%{UNIFI_DEV_TYPE} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{WORD:unifi_interface}: %{UNIFI_EVENT_TYPE:unifi_sta_event_type} %{GREEDYDATA:unifi_sta_event}",
        "message", "%{SYSLOG5424PRI}%{CISCOTIMESTAMP:timestamp}%{UNIFI_DEV_TYPE} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{WORD:unifi_interface}: STA %{MAC} DRIVER: %{GREEDYDATA:unifi_sta_event} addr=%{MAC:unifi_sta_mac} %{GREEDYDATA}",
        "message", "%{SYSLOG5424PRI}%{CISCOTIMESTAMP:timestamp}%{UNIFI_DEV_TYPE} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{WORD:unifi_interface}: STA %{MAC:unifi_sta_mac} %{GREEDYDATA:message}",
        "message", "%{SYSLOG5424PRI}%{CISCOTIMESTAMP:timestamp}%{UNIFI_DEV_TYPE} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: wevent.ubnt_custom_event\(\): %{WORD:unifi_sta_event} %{WORD:unifi_interface}: %{MAC:unifi_sta_mac} / %{IP:unifi_sta_ip}",
        "message", "%{SYSLOG5424PRI}%{CISCOTIMESTAMP:timestamp}%{UNIFI_DEV_TYPE} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: wevent.ubnt_custom_event\(\): %{WORD:unifi_sta_event} %{WORD:unifi_interface}: %{MAC:unifi_sta_mac} / %{INT}",
        "message", "%{SYSLOG5424PRI}%{CISCOTIMESTAMP:timestamp}%{UNIFI_DEV_TYPE} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:unifi_sta_event} %{MAC:unifi_sta_mac} %{WORD:unifi_interface} \(%{GREEDYDATA:message}\)",
        "message", "%{SYSLOG5424PRI}%{CISCOTIMESTAMP:timestamp}%{UNIFI_DEV_TYPE} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:message}"
      ]
    remove_field => [ "syslog5424_pri", "@version" ]
    overwrite => [ "message" ]
    }
    mutate {
    remove_tag => [ "_grokparsefailure" ]
    }
}