filebeat.inputs:
  - type: log
    enabled: true
    paths:
      - /output/*.csv
    exclude_lines: ['^src_ip']
    encoding: utf-8
    scan_frequency: 5s
    close_inactive: 1m

processors:
  - script:
      lang: javascript
      source: >
        function process(event) {
          var msg = event.Get("message");
          if (!msg || msg.indexOf("src_ip") === 0) {
            event.Cancel();
            return;
          }
          var p = msg.split(",");
          if (p.length < 55) {
            event.Cancel();
            return;
          }
          event.Put("src_ip", p[0]);
          event.Put("timestamp", p[5]);
          event.Put("Dst Port", parseFloat(p[3]));
          event.Put("Protocol", parseFloat(p[4]));
          event.Put("Flow Duration", parseFloat(p[6]));
          event.Put("Flow Byts/s", parseFloat(p[7]));
          event.Put("Flow Pkts/s", parseFloat(p[8]));
          event.Put("Fwd Pkts/s", parseFloat(p[9]));
          event.Put("Bwd Pkts/s", parseFloat(p[10]));
          event.Put("Tot Fwd Pkts", parseFloat(p[11]));
          event.Put("Tot Bwd Pkts", parseFloat(p[12]));
          event.Put("TotLen Fwd Pkts", parseFloat(p[13]));
          event.Put("TotLen Bwd Pkts", parseFloat(p[14]));
          event.Put("Fwd Pkt Len Max", parseFloat(p[15]));
          event.Put("Fwd Pkt Len Min", parseFloat(p[16]));
          event.Put("Bwd Pkt Len Max", parseFloat(p[19]));
          event.Put("Bwd Pkt Len Min", parseFloat(p[20]));
          event.Put("Pkt Len Max", parseFloat(p[23]));
          event.Put("Pkt Len Min", parseFloat(p[24]));
          event.Put("Fwd Header Len", parseFloat(p[28]));
          event.Put("Bwd Header Len", parseFloat(p[29]));
          event.Put("SYN Flag Cnt", parseFloat(p[51]));
          event.Put("RST Flag Cnt", parseFloat(p[52]));
          event.Put("PSH Flag Cnt", parseFloat(p[53]));
          event.Put("ACK Flag Cnt", parseFloat(p[54]));
          event.Put("label", "");
        }
  - drop_fields:
      fields: ["message", "log", "input", "agent", "ecs", "host", "@version", "@timestamp", "@metadata"]
      ignore_missing: true

output.kafka:
  hosts: ["kafka:9092"]
  topic: "network-logs"
  codec.json:
    pretty: false

logging.level: info
