From 6aeb21b7d4cd820d41c2071719d8e4f8d01660f1 Mon Sep 17 00:00:00 2001 From: Andrew Kroh Date: Thu, 16 Sep 2021 14:29:17 -0400 Subject: [PATCH] Create custom journald input package Create a generic package for ingesting journald logs. --- packages/journald/_dev/build/build.yml | 3 + packages/journald/_dev/build/docs/README.md | 8 + .../_dev/deploy/docker/docker-compose.yml | 8 + .../deploy/docker/sample_logs/test.journal | Bin 0 -> 8388608 bytes packages/journald/changelog.yml | 6 + .../_dev/test/pipeline/test-iptables-raw.log | 21 + .../pipeline/test-iptables-raw.log-config.yml | 6 + .../test-iptables-raw.log-expected.json | 1509 +++++++++++++++++ .../log/_dev/test/pipeline/test-ubiquiti.log | 11 + .../pipeline/test-ubiquiti.log-config.yml | 6 + .../pipeline/test-ubiquiti.log-expected.json | 632 +++++++ .../_dev/test/system/test-journald-config.yml | 7 + .../log/agent/stream/journald.yml.hbs | 29 + .../elasticsearch/ingest_pipeline/default.yml | 54 + .../journald/data_stream/log/fields/agent.yml | 2 + .../data_stream/log/fields/base-fields.yml | 12 + .../journald/data_stream/log/fields/ecs.yml | 22 + .../journald/data_stream/log/fields/input.yml | 204 +++ .../journald/data_stream/log/manifest.yml | 41 + packages/journald/docs/README.md | 76 + packages/journald/img/systemd-logo.svg | 5 + packages/journald/manifest.yml | 27 + 22 files changed, 2689 insertions(+) create mode 100644 packages/journald/_dev/build/build.yml create mode 100644 packages/journald/_dev/build/docs/README.md create mode 100644 packages/journald/_dev/deploy/docker/docker-compose.yml create mode 100644 packages/journald/_dev/deploy/docker/sample_logs/test.journal create mode 100644 packages/journald/changelog.yml create mode 100644 packages/journald/data_stream/log/_dev/test/pipeline/test-iptables-raw.log create mode 100644 packages/journald/data_stream/log/_dev/test/pipeline/test-iptables-raw.log-config.yml create mode 100644 packages/journald/data_stream/log/_dev/test/pipeline/test-iptables-raw.log-expected.json create mode 100644 packages/journald/data_stream/log/_dev/test/pipeline/test-ubiquiti.log create mode 100644 packages/journald/data_stream/log/_dev/test/pipeline/test-ubiquiti.log-config.yml create mode 100644 packages/journald/data_stream/log/_dev/test/pipeline/test-ubiquiti.log-expected.json create mode 100644 packages/journald/data_stream/log/_dev/test/system/test-journald-config.yml create mode 100644 packages/journald/data_stream/log/agent/stream/journald.yml.hbs create mode 100644 packages/journald/data_stream/log/elasticsearch/ingest_pipeline/default.yml create mode 100644 packages/journald/data_stream/log/fields/agent.yml create mode 100644 packages/journald/data_stream/log/fields/base-fields.yml create mode 100644 packages/journald/data_stream/log/fields/ecs.yml create mode 100644 packages/journald/data_stream/log/fields/input.yml create mode 100644 packages/journald/data_stream/log/manifest.yml create mode 100644 packages/journald/docs/README.md create mode 100644 packages/journald/img/systemd-logo.svg create mode 100644 packages/journald/manifest.yml diff --git a/packages/journald/_dev/build/build.yml b/packages/journald/_dev/build/build.yml new file mode 100644 index 000000000000..a138b554aa08 --- /dev/null +++ b/packages/journald/_dev/build/build.yml @@ -0,0 +1,3 @@ +dependencies: + ecs: + reference: git@1.11 diff --git a/packages/journald/_dev/build/docs/README.md b/packages/journald/_dev/build/docs/README.md new file mode 100644 index 000000000000..64cd7270cf6c --- /dev/null +++ b/packages/journald/_dev/build/docs/README.md @@ -0,0 +1,8 @@ +# Journald Input + +The journald input integration reads logs from the `journald` system service. +The journald input reads the log data and the metadata associated with it. + +The journald input is available on Linux systems with `systemd` installed. + +{{fields "log"}} diff --git a/packages/journald/_dev/deploy/docker/docker-compose.yml b/packages/journald/_dev/deploy/docker/docker-compose.yml new file mode 100644 index 000000000000..a07f1a5d10f2 --- /dev/null +++ b/packages/journald/_dev/deploy/docker/docker-compose.yml @@ -0,0 +1,8 @@ +version: '2.3' +services: + journald: + image: alpine + volumes: + - ./sample_logs:/sample_logs:ro + - ${SERVICE_LOGS_DIR}:/var/log + command: /bin/sh -c "cp /sample_logs/* /var/log/" diff --git a/packages/journald/_dev/deploy/docker/sample_logs/test.journal b/packages/journald/_dev/deploy/docker/sample_logs/test.journal new file mode 100644 index 0000000000000000000000000000000000000000..c42b825e62dcb7e934e0dc17cc218e46de463a66 GIT binary patch literal 8388608 zcmeF)3wU02nIP~$DeZ`tV2h#yHR3J{BeY4rFKMakrP$-8#A9ucw@H_S6?XG_icmJ+ps#$H#BG<&5!fIp>JapStbZ z57e*w>rqRmzxT(_H0{drl)idp^3%5C(ih5qnoEDk7TPjC-Q3cVPkwl7_WC>1mrE8O zab)sSV-`0&o6f&!<@#&Kd}nk?P3_Jby5r?vJ%9YEg^|m%d8cPF!pE{7MrUzbwr=cy zqjA%Yw4R7>G|y0(cgp=~zY!00-Df?Vt{?GGuiy1Vx_-oguD|BVbbiEv&hKyhy64jT z5ohj7w2Xbbj&pt&gVpA{OsI)Z1IL>%oYJdj0;^J1hIXjo9D# z!QOx4&h-6_I5yjkSX|%C?0AS+yuWyR-F<2Ph+7}ej;AaZk1xxvhawj5Kj_;pruCIX z+|LC!XZKGL_cL9;(_6ChV#IzY7%->;HQDooi2W6_A-n&G*x&g6_IGVhkN1ehpx5sAZ>xhSX{jJ&Y z7O{B!?b-8pbHK5FkK+009C72oNAJ)CD$Hr@zlU;!y8L z{R9XQAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+ z009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBly zK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF z5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV6Rw2(&$vOWKS$5_;An0RjXF5FkK+ z009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBly zK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF z5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk z1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7e? z$Q9WBP%ddc;>eZIIROF$2oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C7 z2oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N z0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+ z009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBly zK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF z5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk z1PBlyK!5-N0t5&UAV7cs0RjXDSKzvn^GN{_2e%rl6Cgl<009C72oNAZfB*pk1PBly zK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF z5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7csfrBH^_EIiM9P!|+A}av`1PBly zK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF z5FkLHSD@y_^#9)&v3HN32oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C7 z2oNAZfB*pk1PBlyK!8B6z>Tk@fB!sU?;bx9AV7cs0RjXF5FkK+009C72oNAZfB*pk z1crye?w8X)4~aNDy3z#!0t61ez|8y7^Jm0^zoHcg5FkK+009C72oNAZfB*pk1PBly zK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF z5FkK+009C72oNAZfB*pk1PBlyK!5;&p)PRyxO~z=#G&4g`UwyqK!5-N0t5&UAV7cs z0RjXF5FkK+009C72oNAZfB*pk1V*;NrUmKWhlx0{HFQsa009C72oNAZfB*pk1PBly zK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF z5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk z1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72n+>*CFAl*nGuIV&1xh-fB*pk1PBly zK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF z5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk z1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs z0RjXF5FkK+009F132b^Wmkf#6-+2285FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&U zAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!Ct-6u9wC`J}Cg!?8y_5gtJ!I_R4K0RjXF5FkK+ z009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBly zK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF z5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk z1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs z0RjXF5FkK+009C72oNAZ;PnO8PR%DfBEJ48uM!|YfB*pk1PBlyK!5-N0t5&UAV7cs z0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZ zfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&U zAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C7 z2oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N z0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+ z009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5I8gfrBCIOg(4oBRjopR009C7 z2oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N z0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+ z009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBly zK!5-N0t5&UAV7cs0RjXF5FkK+009C72oUI7pyjRkWM{;_N7_Sx009C72oNAZfB*pk z1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs z0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZ zfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&U zAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C7 z2oNAZfB*pk1PBlyK!Ct-7a03QE@?61aPL=t1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+ zz~Bq)`dB_GBI4jzqyhp22oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C7 z2oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N z0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+ z009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBly zK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF z5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk z1cr;i_UCd*D-nlFU-}?GfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZ zfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&U zAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C7 z2oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N z0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+ z009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBly zK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF z5FkK+009C72oNAZfB=F06IgvlK1mR9|FW4)fB*pk1PBlyK!5-N0t5&UAV7cs0RjXF z5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk z1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs z0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZ zfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&U zAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C7 z2oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N z0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+ z009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBly zK!5;&LnkoyLx&d009C72oNCfMg-Q4Pyaqz#5a<|90CMJhCt1!>G>k!$mm*^ z1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs z0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZ zfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&U zIPd~BQ}apEhzEWJ84o9c4bSJ2av~m1wW);w0RjXF5FkK+009C72oNAZfB*pk1O`vw z_;Kl<7epMqN~}zP009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C7 z2oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N z0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5;&ktMM8#az;G#F5p#ZV3<| zK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF z5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk z1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfWR9QSo3%;nHcenWig8Y0RjXF z5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjX{ew+S%te%L3009C72oNAZ zfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&U zAV7cs0RjXF5FkK+009C72oM;sK8UX?X2oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C7 z2oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAJL>s009C7_7r$`KHZME=U!U`2oNAZ zfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&U zAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C7 z2oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N z0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+ z009C72oNAZfB*pk1PBlyK!5-N0t60gfsM!Jllmg|SM2el)A14e8*e{>gDKF~mL880 z59V5O6Cgl<009C72oNAZfB*pk1PBlyK!5-N0;xbtE`2^9kqZF=1PBlyK!5-N0t5&U zAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C7 z2oNAZfB*pk1PBlyK!5-N0t5&Ucs+qF$ECl&F5>Hr@fraF1PBlyK!5-N0t5&UAV7cs z0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZ zfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72<$D;mHoc=h|i%6Y)UjmyZAe0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N z0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+ z009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBly zK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF z5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk z1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs z0RjXF5FkK+009C72oNAZfB*pk1PBlyKwx+YY(68OG!$`ob*CEw1PBlyFfs+oU(F?r zM;w_7x+Xw?009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZ zfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72#g$ouHU70GA-2oNAZ zfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&U zAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C7 z2oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N z0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlqS^`^6&nE>(99q?@mH+_)1PBly zK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF z5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk z1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs z0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZ zfB*pk1PBlyK!5-N0t5&UAV7cs0RjYuiomW<Xg-jPenjyM#1 zP%{An1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1crh@TS-1CGvZLF zS&ak;5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZ zfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&U zAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C7 z2oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N z0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+ z009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBly zK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7csfuSsL z*2H{Le#D{Ni`oegAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs z0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZ zfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&U zAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&U7}^4D=jW3KA`b0tR8N2a z0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZ zfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&U zAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0z*|`-L_m(dc>jHhq?(6AV7cs z0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZ zfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&U zAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C7 z2oNAZ;P(r(9FtE5MEw1u?Il2f009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF z5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk z1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs z0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0Ro4Iz}UxgNg)vrkE&Eb zfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&U zAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C7 z2oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N z0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+ z009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBly zK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF z5FkK+009C72oNAZfB*pk1PBlyKwx+X+}M&&8i_bOy3z#!0t5&UAV7cs0RjXF5FkK+ z009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBly zK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF z5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk z1PBlyK!5-N0t5&UAV7cs0RjXF5Fjv|1X_;GC+$QWPQB@c009C72oNAZfB*pk1PBly zK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfWSx-Sp9G=X*uFZ>tDYF2oNB!Zvq=% zO2026?%OP*2oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk z1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs z0RjXF5FkK+009C72oNAZfB=C5DKPe!e3CBWfy^xz0RjXF5Fju(0y7^;|GmJ7gHwf7 z2@oJafB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N z0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+ z009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBly zK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF z5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk z1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs z0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZ zfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&U zAV7cs0RjXF5FkK+009C72oNAZfWYA;uz6HIDJbIMRh?=G5FkK+009C72oNAZfB*pk z1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs z0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZ zfWW>9ly1u<10(L+ETaezAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&U zAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C7 z2oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N z0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+ z009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBly zK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF z5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk z1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs z0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZ zfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&U zAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C7 z2oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N z0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5;&Ln*N4WBFvch=+1*YY`wo zfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&U zAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C7 z2oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N z0t5&UAVA=77ASpBJ}EEa;ascQ2oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+ z009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBly zK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF z5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk z1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs z0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5Fl_c1=hZpOVUR? zm}?D(+?(t2NgEM|Lr;1jK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBly zK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF z5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk z1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs z0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZ zfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkKcWC*m}pGz8zI5N7{B>@5i2oNAZfB*pk z1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs z0Ro4Ez}PeLNf{9jhnmztfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZ zfB*pk1PBbSz=jvne@`Xi;8tUG0t5&UAV6R+1lB!~UJpbZj2f&-fB*pk1PBlyK!5-N z0t5&UAV7csf#D#q=F#+dYsBHulO6~VAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBly zK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF z5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk z1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs z0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZ zfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&U zAV7cs0RjXF5FkK+0D*xC)a=Y96Cw_5w$TI#5FkK+009C72oNAZfB*pk1PBlyK!5-N z0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+ z009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBly zK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF z5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk z1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5;&;U}=<CyLCq0w1(LY&F9s|s3Wt1le74rKi%B*59PB*#r)m7(~(8&=%9h&scqYHRN48PAumiun=ys#ugLiFpyDo(=Cz`#U<@ z(Kx?h-u&)2usVGq>L}0lf9oS9U2i%0xfzjX>wW3_7xQBM3$p>&eB;G`dhhqY_rGI& z#8^MJW8R$lrlz{H>suS9*LHT~Y9=qPnml=7O+LS{W^wzJe9huquA_a?l=jJ0ooRtl zUpO6e_qs{Pu0G+Nk+7H2czh(oEnb7jL-~PiVE{=H-`>C_GDLJajvV*GZ zlu4Jiubi}O#RZeHS0+`JSG6x*)cxPw!hE6p_Uhc^{FL_2+?2|i{N#M)sbx!7l}(vk zJ+XYwX=TgXSC>u6RZgrd{9Hb@Z1Kv@&WULy(dVSBuuY@?cJf_q^=qTfwzl+r%=+y4 z{Cq4MaOKngeCd~7x$>15AF;3gK0I&1{JC|rTj$ozsV{0WnHu$^tCo};{mpSdeCccV z*GJxMzfIj=o2PqUxL=VCJiYqSk}+rgNo~xF*k4_Zb&o(^6QaI2FRr=ahZjCF`$G$& zu84irH>a*8v6?b@a#eX{WqD0DA?k|H!PQHCbaU65<6ez?Z4aeh+5DdOEf#+4$m37G zsAb0T7$32pI(m$f4`*Rg)RCPgOWya`hUeGp{15*x@@?O;f{mymoy8kD?jCm3Ft*+pzn3&7Hv7)Z{px^YZ>sP;H{M7R!Z|U~etE-2t z=Y0&fua6&f)h$mvyU*`q(r?|lbq%xYrp~Uft*)uAuFh50l*jj4)EDpPRmYw1Pv?K( zmSs`j#@E)@lV@+YAAkDHhbDH+_=lJm@%Os*i96C+{P#aVySK z7!=3bylleM7q0r@ADwme=9nL`uli;;%xP#YoEqX&7*3~W6L&OR|GCj^e|BZ$*`C#t z%qzSY>o;Ws{`LE9tG8W#;`K2;;_qEQSkkY?WJ=T#-#;tP|H@@szVP)4k#EV4)Fr8- z_b}?IXI3`w#I7lK{`+Ugtc-aP`>LmhxHdgJ^&|FMN7$54O{PRWalU-p&ExWO#@u^Pe5qBHb3f#>&9z0 z9Pz`SH*WsRm>03HdRiL`S8NqiauwNye$;VVHnHnF7jArV_n)ngJe$u<-?{F2-LJ*^ zabfwU*?&_r=STN`DaJ>P^|uvWx3(@QtY3Ibir4-4v_Ji~quL)H9rJ5mO#AO1-~C$g zx|NrF;JhqGOUet3*%qAZhSBO z)iK}rT>cw>AE%?3*0XNB5cRfBn>S}p@jXppQ1l<4&)d#B@jVZGa{m07zh+wI-aWtY zV&q$x4Y=lp%76LXC!cwHjE@-o$9BwXt#7HXowRJ}!b#cvRm48-v*LKT=L>gF$Ti=z zJM!H=E~~4Mulu#gzc?H4!7u*tKTd3D{EHYLvCq1u&6z&CVQ#;*g;&7eHoB?vu6HlH zAo7=v53e*|)D_=DpRK!P&VqHLPmb{s`>w05v9*52jQVNK4d>R^R#xT9D+}L39nojh z6W>GEy!F8??Z3EheB@o%Q_pMj^m@gG#7D=Jelb6x_41e(vCp~+H@MC9bEdaWJA3}T z1&y`Y+cFWee((CKvV;#@u=Mi(^MAKJ8Tq@4>+8-}*ctD0+&`^& z;+P*C-PrQqVqV0kud(>N5dAjIZkSe|6_{!!Q;Xl{lXtdN%$oATFCuT*li7J{k379~ zU6u_z`TL{BU3_lGXJTH&s4KRkpVr9NF!$Vf)9RWV=FRQC*Ph%_QPHueaBo_jtIFpl zFKl1jSy|ChxJ9k1sII7Kujx6joRKB`@bubmAAREVDZ5@t>)cZ8xJUlpx|e427hF4Q z$rt|or{9VCB1YXCk4%r7xRGz2I&WTcccqKla~+kPx$>IwMIHH$MO6zst2!1|wdZr4 z75VZ-Rq;I>zVW%f{ML(4_|SyASHwD9zsr2Hyy3Gf8}R69S9IQTR_DDjK4R3jy|}(P zb<<`R&Ntm9_IJzQoh#}~t0*aX_L;>OeD~fR-G^TCpVI929kll5OW5DIW)2MuM@7p~he(yqS z%+FSe2YGE-g2p4#A8uN?{@O9$8C`PE&))IoQww8X_|U}iHTTT^??qlNqDefEMer0BMeH`}*alIVZ<#F8_ z*U54H7}u$B{TA1YrH`e4alLk3wjI|`V;@iV$92t`Y&)(u#y*kmkMI3;*>-&2*6d98 z$M@WpY&*VR*6d36$N4+XTXDX;Jv)!Zc`814@%fMAJU(x6oW*e+*I98r+ftey&vAU0 z9FcA>8J)%rZ%$);P8zf0^p2*l?|AT!o{ht`B#x_?fBcwq-m%&E-sh^d?UyWC`l-kl z&ow`KaW;Zv?sc-H6pQh%zIgPayRa2_+ zmART+MOCh%Ji8-}&*RiA(PJOD@8XRwUD0zLyXzBay?y6RC&v2WaP*FsesjcE*1tRI z>xo(2jl~Xi3#KF>GSa{fwtE`T?(s#XZUHqA=U%Gqqn|hwVY=17@)7m>PSt9C) z`_OMsnJ|0C^yX&Fj$`K9>^XV=`6e6IKVD9%?eRNS@o+qXXS^rn*3rS1I8C+21O zqmFa3?PI<&W5(LjkM~@!#Q7+Wi?u}_g|E*&{+uISrT6>oBU#?%XN|u8SJR&Binijs z7I`lN-PJ{>WRBo$n%VydHgK&x325>ZcX1_#4aG zFIl>%@Bp&BysYPk3*wbkovUgq%DM`hl@*mWm1P|(mM^b8skwdCg-snxIu~8CtaIgz z6(^N-uI{WoY0@RD3eULFVEWBq8bGvU5;{z7Q@#HMQHS>@B(Y=d57?;l_8(!Gs zIF9)}??*#6@9*Dx-7`P^!KgopI^z5r???IA^a$xWue`R1!ldXg^4)jtU1xoM@r*d_ zmBjfw@+~RO*M0vPO}!>xeBK{znmzr?Kbz5eyhNdy*Sg|->F1@X@W(KPOT*fVaEkkp zt0(^JfBKh4#(z1|Y>oTcJ?8cH70(l{IPt5ue&)LIbull#x1z6jJv@@<3CUrY?upmq ze)+RI$IW>5efNGP=Ee6~@$JTKoHr4um=s2Wo8HkfVNwDLoExE zzWQ30@2*!XUvFnUY5&6y@9T6@u6@f4w%O&lF{eMY=<4LRsJxFU`-{@6NZN! za>_HCJ-%d<>Uvi4Nt`_WYUS$diT6LYzbaF%eaZ|DIP=B-e)=4nIB~Q%6OS|&x}`DkIZ+kJImNT(;x%m+5cPzonh0e@XjFdrn-Z9VLzuzp1~(O$NmDck|2j zmbACp`Tvbu6medgZuv0Nb-bm>Z%yY*d(3^p$osjs!4sqI(R*pHO+-r@EezwdrxO1a*ZcDJlN zPP-VjVG*y1>rv&pLF&1-zZkJ|@%hwu))&&hT)%zs@3rY>4Kv-{!%R17%<#(jzG0?Y zHq3ORcNtze=MFR7eZx#QcGuyRbKWr1JvhvCmA4JAob!j7Zuv0Nb-aD;%9(L6KE-Z1dPzkDhqjJ?Zb$f8>05Kk3T( zWifuXRI20W%jE|*d-&P=$DQ>LmnU8NpX9fqEPuv{;fhwrmp|Mi@OX|C;K1N_n4^dd@s3 z>o-$ci}*=>AG}R*oO#ok=Ke2nlYDbr`?{uda}O%d zQlJ?6VF~b=adge;(|t^4#g1IbCO-JEu&Te6yZ%>0ujQ zaOC5MR`Ck^b9zV1%%+}}#MESB-dh;cXwg z>6YZ1=fcVNuG)O7`>p!c!dJ&bKYyOlY3o(N^iKbhUK0ceTuz(b(D6(bX}%y}7${ z#`M;n%Jk~^Jgo#ht{k6t`|c(E^RqK5FAq9DoAc%`T>8z24p>pUpCixD>g`{s-Cr=& z@jc(0O23@%ccniau~kve>HkKR`x4U+%qox5jf8_Masl zvX3hDS33?Zn^BZ6^_cPU#(j(TmmOcc)}|Xhb9m|I4l~_-Lrj}8;dBL}T zvd_mZZcM(J*VR4Ws_VurP1XK7>&9O><>o`a{5QY(K=MnwN`4b7h1+XeH*T)9x3#}6 z*Ns1S$)tOle%*R)u0Q=qu77UL^_Ta(y_Zv@sJ-t!KI_J(U019de|d||`xd2Z_to9l zc-D&#Tz11HL+uwcFU|9*Kelz_1?BUdYP;L6h|jc($>nk4dUCn$n|e+=O#7YEarF)# z_{rmUrv8(E?spc9E%G12x>ZYi??$nD?e`N)FIxK1TN$6q-)X&|di`a6=lUCV zE9x)TUp)8eyPP6L-p{(#31$1e{F}G+x8DbL+hx%9`~1jlN4}+Ds}F0xLtD3)ykk)x zX?J&*$7vTMb}IfoaXq43cSt>FzLfdG*n^ADr@pg3QM)dY`9?!~@%d2`i`V-m6|c4V zjyPo9!!TR4qG?*E;)SNn7iMN35HC7rpzn<(qY}+W4Jy4!5eC*8pLOiOiLBIECra{PVYw~F!iQ+p0R{@%CX)}P$I?4EZSe_z}9yQcAWLAlLV!t|{G;@_PXJd|ro}F7cLi^2|@SV$(Z>~G*GI>AgGEc6v zPTtzOcV|05C(ryg>wYJe?d$O8W?tU6uj$ewzP-g@_orvuudH_vgQ_b-s@Bej@QyFFq4jwd;MerWgINbcI9KLH}4>(!XT=p?T(`H*CM{Ru`rJ z$^B98UzRi#PD5CK=xk|ftGn;?h&^XtdclJSK9%#Of6w{ye#$v;yl!1>ync7tpN#*} zg;(_TCl~Ge#Geh;pWJle{ns^|zr(%8>miQUYgo^^uY5j~IGR{Kk54_<>u0L#oK$zcpLX<5pQShH+Z~V zy5HL_KWW)lmW#J_8*fX>_3_kmy|}5Z@6>xCPS5|rfAsf@pKIB9#9;m6 z!DC*zxBKhY+$v6o7N^;tS#N*%igMgc98D>oH>REwrz=viUHHK+NV9p*Y~@7HRtGv!XfhMO+!BmMu^7QcVNABCiuRQK zWY?GT+r(4iCG+Fm588OYIa}{`S>mZW-zlGK=KZ8w^S-0b-aR^%_ImpkzIVZvEAHIn z?wr0M{eI>}tDSGazN6K@uln7)+kZ3qmG|W54H|O2_3}$Q8REW$-d{;;eO>Nb*k<9f zO&fmPRsFtho^$8==e?um{-$rga#P>s6w+DO&2y8J%l3BY{CD=Zx66L?=|S7uHMbqT z-ML>n{zUg1L%ZMDc)y}P((dM#$7vVK%Hza!em6DsoOYN7^vt$zd}+(3j+@hNl7F7N z=KZ8wyY|~y{e_vN%RKz8JD&W)?LWJAV)9M->z;4b_S?Gh`*P2f8BCmXbN7bZUiq2i zm+P;W-)nEb`2nNf?GGEp@rd$5pZwwHpSa?IYj@9eXPn?uJCS_m!_bjHB?e_R9 zi*~#CXM?xf_qV-+QXDOc7J@_y2-MSE}V{XzMrdgJxomt1ws zM=K9*ntXHJbrE{!t&Mfpo9^8A zsE=*mFs=GKG+Cdhd%gkdO--xq^O#x2$JT%Um;Lc^!n2PJ8Xxcf+DQ++^%qNh4`hh@ zJn}u^df$^CTkZ!<94#u3Q_uCrsnmD&6J;M%;%$9DDIR+FN_SwNxkGx=%Xndov!pV`Snj<*R$X0r9r__xZZZc)RvLf6yOq zk8E@3pz*fw-910w`ja<5CfOn9n4ZZEv%y@ST>iofVM>jORC z{J8n)!1-zZ&VAx3^Mxr1tn#%su4?{yjfe7GBasgfAV7cs0RjXF5FkK+009C72oNAZ zfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&U zAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C7 z2oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N z0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+ z009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBly zK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF z5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk z1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs z0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZ zfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&U zAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C7 z2oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N z0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+ z009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBly zK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF z5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk z1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs z0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZ zfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&U zAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C7 z2oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N z0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+ z009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBly zK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF z5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk z1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs z0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZ zfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&U zAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C7 z2oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N z0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+ z009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBly zK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF z5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk z1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs z0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZ zfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&U zAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C7 z2oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N z0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+ z009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBly zK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF z5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk z1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs z0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZ zfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&U zAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C7 z2oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N z0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+ z009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBly zK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF z5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk z1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs z0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZ zfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&U zAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C7 z2oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N z0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+ z009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBly zK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF z5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk z1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs z0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZ zfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&U zAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C7 z2oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N z0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+ z009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBly zK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF z5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk z1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs z0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZ zfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&U zAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C7 z2oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N z0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+ z009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBly zK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF z5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk z1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs z0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZ zfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&U zAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C7 z2oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N z0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+ z009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBly zK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF z5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk z1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs z0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZ zfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&U zAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C7 z2oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N z0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+ z009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBly zK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF z5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk z1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs z0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZ zfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&U zAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C7 z2oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N z0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+ z009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBly zK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF z5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk z1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs z0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZ zfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&U zAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C7 z2oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N z0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+ z009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBly zK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF z5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk z1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs z0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZ zfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&U zAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C7 z2oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N z0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+ z009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBly zK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF z5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk z1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs z0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZ zfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&U zAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C7 z2oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N z0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+ z009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBly zK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF z5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk z1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs z0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZ zfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&U zAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C7 z2oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N z0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+ z009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBly zK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF z5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk z1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs z0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZ zfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&U zAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C7 z2oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N z0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+ z009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBly zK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF z5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk z1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs z0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZ zfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&U zAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C7 z2oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N z0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+ z009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBly zK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF z5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk z1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs z0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZ zfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&U zAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C7 z2oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N z0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+ z009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBly zK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF z5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk z1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs z0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZ zfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&U zAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C7 z2oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N z0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+ z009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBly zK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF z5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk z1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs z0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZ zfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&U zAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C7 z2oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N z0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+ z009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBly zK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF z5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk z1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs z0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZ zfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&U zAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C7 z2oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N z0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+ z009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBly zK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF z5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk z1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs z0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZ zfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&U zAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C7 z2oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N z0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+ z009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBly zK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF z5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk z1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs z0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZ zfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&U zAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C7 z2oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N z0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+ z009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBly zK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF z5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk z1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs z0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZ zfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&U zAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C7 z2oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N z0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+ z009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBly zK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF z5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk z1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs z0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZ zfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&U zAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C7 z2oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N z0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+ z009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBly zK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF z5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk z1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs z0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZ zfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&U zAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C7 z2oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N z0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+ z009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBly zK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF z5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk z1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs z0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZ zfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&U zAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C7 z2oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N z0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+ z009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBly zK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF z5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk z1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs z0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZ zfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&U zAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C7 z2oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N z0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+ z009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBly zK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF z5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk z1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs z0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZ zfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&U zAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C7 z2oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N z0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+ z009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBly zK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF z5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk z1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs z0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZ zfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&U zAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C7 z2oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N z0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+ z009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBly zK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF z5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk z1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs z0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZ zfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&U zAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C7 z2oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N z0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+ z009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBly zK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF z5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk z1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs z0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZ zfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&U zAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C7 z2oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N z0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+ z009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBly zK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF z5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk z1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs z0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZ zfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&U zAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C7 z2oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N z0t5&UAV7cs0RjXF5FkK+0D=E+hYm;p00004{eRt#KqqLxfB^#r3>YwAz<>b*1`HT5 zV8DO@0|pEjFkrxd0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM z7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM7%*VKfB^#r3>YwAz<>b* z1`HT5V8DO@0|pEjFkrxd0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd z0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM7%*VKfB^#r3>YwA zz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@0|pEj zFkrxd0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM7%*VKfB^#r z3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@ z0|pEjFkrxd0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM7%*VK zfB^#r3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5 zV8DO@0|pEjFkrxd0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM z7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM7%*VKfB^#r3>YwAz<>b* z1`HT5V8DO@0|pEjFkrxd0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd z0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM7%*VKfB^#r3>YwA zz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@0|pEj zFkrxd0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM7%*VKfB^#r z3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@ z0|pEjFkrxd0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM7%*VK zfB^#r3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5 zV8DO@0|pEjFkrxd0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM z7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM7%*VKfB^#r3>YwAz<>b* z1`HT5V8DO@0|pEjFkrxd0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd z0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM7%*VKfB^#r3>YwA zz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@0|pEj zFkrxd0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM7%*VKfB^#r z3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@ z0|pEjFkrxd0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM7%*VK zfB^#r3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5 zV8DO@0|pEjFkrxd0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM z7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM7%*VKfB^#r3>YwAz<>b* z1`HT5V8DO@0|pEjFkrxd0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd z0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM7%*VKfB^#r3>YwA zz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@0|pEj zFkrxd0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM7%*VKfB^#r z3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@ z0|pEjFkrxd0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM7%*VK zfB^#r3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5 zV8DO@0|pEjFkrxd0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM z7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM7%*VKfB^#r3>YwAz<>b* z1`HT5V8DO@0|pEjFkrxd0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd z0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM7%*VKfB^#r3>YwA zz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@0|pEj zFkrxd0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM7%*VKfB^#r z3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@ z0|pEjFkrxd0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM7%*VK zfB^#r3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5 zV8DO@0|pEjFkrxd0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM z7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM7%*VKfB^#r3>YwAz<>b* z1`HT5V8DO@0|pEjFkrxd0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd z0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM7%*VKfB^#r3>YwA zz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@0|pEj zFkrxd0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM7%*VKfB^#r z3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@ z0|pEjFkrxd0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM7%*VK zfB^#r3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5 zV8DO@0|pEjFkrxd0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM z7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM7%*VKfB^#r3>YwAz<>b* z1`HT5V8DO@0|pEjFkrxd0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd z0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM7%*VKfB^#r3>YwA zz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@0|pEj zFkrxd0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM7%*VKfB^#r z3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@ z0|pEjFkrxd0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM7%*VK zfB^#r3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5 zV8DO@0|pEjFkrxd0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM z7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM7%*VKfB^#r3>YwAz<>b* z1`HT5V8DO@0|pEjFkrxd0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd z0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM7%*VKfB^#r3>YwA zz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@0|pEj zFkrxd0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM7%*VKfB^#r z3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@ z0|pEjFkrxd0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM7%*VK zfB^#r3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5 zV8DO@0|pEjFkrxd0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM z7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM7%*VKfB^#r3>YwAz<>b* z1`HT5V8DO@0|pEjFkrxd0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd z0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM7%*VKfB^#r3>YwA zz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@0|pEj zFkrxd0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM7%*VKfB^#r z3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@ z0|pEjFkrxd0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM7%*VK zfB^#r3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5 zV8DO@0|pEjFkrxd0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM z7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM7%*VKfB^#r3>YwAz<>b* z1`HT5V8DO@0|pEjFkrxd0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd z0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM7%*VKfB^#r3>YwA zz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@0|pEj zFkrxd0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM7%*VKfB^#r z3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@ z0|pEjFkrxd0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM7%*VK zfB^#r3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5 zV8DO@0|pEjFkrxd0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM z7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM7%*VKfB^#r3>YwAz<>b* z1`HT5V8DO@0|pEjFkrxd0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd z0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM7%*VKfB^#r3>YwA zz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@0|pEj zFkrxd0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM7%*VKfB^#r z3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@ z0|pEjFkrxd0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM7%*VK zfB^#r3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5 zV8DO@0|pEjFkrxd0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM z7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM7%*VKfB^#r3>YwAz<>b* z1`HT5V8DO@0|pEjFkrxd0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd z0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM7%*VKfB^#r3>YwA zz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@0|pEj zFkrxd0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM7%*VKfB^#r z3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@ z0|pEjFkrxd0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM7%*VK zfB^#r3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5 zV8DO@0|pEjFkrxd0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM z7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM7%*VKfB^#r3>YwAz<>b* z1`HT5V8DO@0|pEjFkrxd0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd z0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM7%*VKfB^#r3>YwA zz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@0|pEj zFkrxd0RsjM7%*VKfB^#r3>YwAz<>b*1`HT5V8DO@0|pEjFkrxd0RsjM7%*VKfB^#r a3>YwAz<>b*1`HT5V8DO@0|pEj7!CwYf~a}` literal 0 HcmV?d00001 diff --git a/packages/journald/changelog.yml b/packages/journald/changelog.yml new file mode 100644 index 000000000000..d4c1729b4a67 --- /dev/null +++ b/packages/journald/changelog.yml @@ -0,0 +1,6 @@ +# newer versions go on top +- version: "0.0.1" + changes: + - description: Initial release of generic journald input package. + type: enhancement + link: https://github.com/elastic/integrations/pull/0 # FIXME Replace with the real PR link diff --git a/packages/journald/data_stream/log/_dev/test/pipeline/test-iptables-raw.log b/packages/journald/data_stream/log/_dev/test/pipeline/test-iptables-raw.log new file mode 100644 index 000000000000..bfd1f3e29894 --- /dev/null +++ b/packages/journald/data_stream/log/_dev/test/pipeline/test-iptables-raw.log @@ -0,0 +1,21 @@ +<161>Oct 10 07:25:12 Hostname kernel: [wan-lan-default-D]IN=eth0 OUT= MAC=90:10:20:76:8d:20:90:10:65:29:b6:2a:08:00 SRC=158.109.0.1 DST=10.4.0.5 LEN=52 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=TCP SPT=38842 DPT=443 WINDOW=2853 RES=0x00 ACK URGP=0 +<6>2021-03-12T14:10:18Z Hostname kernel: [wan-lan-default-D]IN=eth0 OUT= MAC=90:10:20:76:8d:20:90:10:65:29:b6:2a:08:00 SRC=158.109.0.1 DST=10.4.0.5 LEN=52 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=TCP SPT=38842 DPT=443 WINDOW=2853 RES=0x00 ACK URGP=0 +2021-03-12T14:10:18Z Hostname kernel: [wan-lan-default-D]IN=eth0 OUT= MAC=90:10:20:76:8d:20:90:10:65:29:b6:2a:08:00 SRC=158.109.0.1 DST=10.4.0.5 LEN=52 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=TCP SPT=38842 DPT=443 WINDOW=2853 RES=0x00 ACK URGP=0 +Jan 8 03:37:09 DENY: IN=eth0 OUT= MAC=90:10:28:5f:62:24:90:10:18:5a:89:2a:08:00 SRC=192.0.2.71 DST=192.0.2.83 LEN=88 TOS=0x00 PREC=0x00 TTL=118 ID=21684 PROTO=ICMP TYPE=3 CODE=3 [SRC=192.0.2.83 DST=192.168.173.191 LEN=60 TOS=0x00 PREC=0x00 TTL=54 ID=0 DF PROTO=UDP SPT=21458 DPT=62936 LEN=40 ] +Jan 8 03:37:09 example-host kernel: iptables DROP_INPUT: IN=eth0 OUT= MAC=90:10:35:5a:1e:3a:90:10:9e:ec:2c:71:08:00 SRC=203.0.113.36 DST=172.16.54.114 LEN=52 TOS=0x00 PREC=0x00 TTL=115 ID=15743 DF PROTO=TCP SPT=17805 DPT=445 WINDOW=8192 RES=0x00 SYN URGP=0 +Jan 8 03:37:57 example-host kernel: iptables DROP_INPUT: IN=eth0 OUT= MAC=90:10:35:5a:1e:3a:90:10:76:e0:e2:d5:08:00 SRC=198.51.100.198 DST=172.16.54.114 LEN=40 TOS=0x00 PREC=0x00 TTL=243 ID=17703 PROTO=TCP SPT=47091 DPT=1433 WINDOW=1024 RES=0x00 SYN URGP=0 +Jan 8 03:38:45 example-host kernel: iptables DROP_INPUT: IN=eth0 OUT= MAC=90:10:35:5a:1e:3a:90:10:9e:ec:2c:71:08:00 SRC=203.0.113.201 DST=172.16.54.114 LEN=52 TOS=0x00 PREC=0x00 TTL=115 ID=19619 DF PROTO=TCP SPT=59319 DPT=445 WINDOW=8192 RES=0x00 SYN URGP=0 +Jan 8 03:39:25 example-host kernel: iptables DROP_INPUT: IN=eth0 OUT= MAC=90:10:35:5a:1e:3a:90:10:9e:ec:2c:71:08:00 SRC=203.0.113.246 DST=172.16.54.114 LEN=40 TOS=0x00 PREC=0x00 TTL=240 ID=4255 DF PROTO=TCP SPT=44181 DPT=80 WINDOW=14600 RES=0x00 SYN URGP=0 +Jan 8 03:40:21 example-host kernel: iptables DROP_INPUT: IN=eth0 OUT= MAC=90:10:35:5a:1e:3a:90:10:76:e0:e2:d5:08:00 SRC=203.0.113.208 DST=172.16.54.114 LEN=52 TOS=0x00 PREC=0x00 TTL=110 ID=27150 DF PROTO=TCP SPT=64358 DPT=445 WINDOW=8192 RES=0x00 SYN URGP=0 +Jan 8 03:40:25 example-host kernel: iptables DROP_INPUT: IN=eth0 OUT= MAC=90:10:35:5a:1e:3a:90:10:9e:ec:2c:71:08:00 SRC=198.51.100.160 DST=172.16.54.114 LEN=40 TOS=0x00 PREC=0x00 TTL=242 ID=7264 PROTO=TCP SPT=58830 DPT=445 WINDOW=1024 RES=0x00 SYN URGP=0 +Jan 8 03:41:17 example-host kernel: iptables DROP_INPUT: IN=eth0 OUT= MAC=90:10:35:5a:1e:3a:90:10:76:e0:e2:d5:08:00 SRC=198.51.100.115 DST=172.16.54.114 LEN=52 TOS=0x00 PREC=0x00 TTL=117 ID=6101 DF PROTO=TCP SPT=51985 DPT=445 WINDOW=8192 RES=0x00 SYN URGP=0 +Jan 8 03:41:23 example-host kernel: iptables DROP_INPUT: IN=eth0 OUT= MAC=90:10:35:5a:1e:3a:90:10:76:e0:e2:d5:08:00 SRC=198.51.100.167 DST=172.16.54.114 LEN=52 TOS=0x00 PREC=0x00 TTL=45 ID=6319 DF PROTO=TCP SPT=4099 DPT=445 WINDOW=8192 RES=0x00 SYN URGP=0 +Jan 8 03:43:18 example-host kernel: iptables DROP_INPUT: IN=eth0 OUT= MAC=90:10:35:5a:1e:3a:90:10:9e:ec:2c:71:08:00 SRC=198.51.100.19 DST=172.16.54.114 LEN=40 TOS=0x00 PREC=0x00 TTL=245 ID=48624 PROTO=TCP SPT=59287 DPT=139 WINDOW=1024 RES=0x00 SYN URGP=0 +Jan 8 03:43:42 example-host kernel: iptables DROP_INPUT: IN=eth0 OUT= MAC=90:10:35:5a:1e:3a:90:10:76:e0:e2:d5:08:00:45:00:00:00:00 SRC=198.51.100.68 DST=172.16.54.114 LEN=40 TOS=0x00 PREC=0x00 TTL=250 ID=54321 PROTO=TCP SPT=53296 DPT=8088 WINDOW=65535 RES=0x00 SYN URGP=0 +Jan 22 09:05:05 ubuntu-bionic kernel: [16571.459614] IN= OUT=lo SRC=2001:0db8:0000:0000:0000:0000:0000:0001 DST=2001:0db8:0000:0000:0000:0000:0000:0002 LEN=104 TC=0 HOPLIMIT=64 FLOWLBL=868225 PROTO=ICMPv6 TYPE=128 CODE=0 ID=3427 SEQ=1 +Jan 22 10:52:34 ubuntu-bionic kernel: [ 307.757925] IN= OUT=enp0s3 MAC=90:10:12:34:56:78:90:10:aa:bb:cc:dd:86:dd:ff:ff SRC=fe80:0000:0000:0000:0084:88ff:feae:790a DST=ff02:0000:0000:0000:0000:0000:0000:0016 LEN=96 TC=0 HOPLIMIT=1 FLOWLBL=0 PROTO=ICMPv6 TYPE=143 CODE=0 MARK=0xd4 +Jan 5 20:17:05 MainFirewall kernel: [LAN_LOCAL-default-A]IN=eth0.90 OUT= MAC=90:10:92:6e:ea:a7:90:10:73:ba:d6:77:08:00:45:fc:02:1c SRC=192.168.48.137 DST=255.55.174.225 LEN=540 TOS=0x1C PREC=0xE0 TTL=64 ID=27223 PROTO=UDP SPT=48689 DPT=48689 LEN=520 +Jan 5 20:17:01 MainFirewall kernel: [WAN_OUT-2000-A]IN=eth0 OUT=eth2 MAC=90:10:20:76:8d:20:90:10:24:67:f4:89:08:00 SRC=192.168.134.158 DST=192.0.2.25 LEN=265 TOS=0x00 PREC=0x00 TTL=63 ID=51768 DF PROTO=TCP SPT=43189 DPT=443 WINDOW=159 RES=0x00 ACK PSH URGP=0 +Jan 5 20:17:01 MainFirewall kernel: [source-dest-default-D]IN=eth0 OUT=eth2 MAC=90:10:20:76:8d:20:90:10:65:29:b6:2a:08:00 SRC=192.168.110.116 DST=192.0.2.25 LEN=52 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=TCP SPT=50093 DPT=1443 WINDOW=2857 RES=0x00 ACK URGP=0 +Jan 5 20:17:01 MainFirewall kernel: [WAN_OUT-2000-A]IN=eth0 OUT=eth2 MAC=90:10:20:76:8d:20:90:10:65:29:b6:2a:08:00 SRC=192.168.110.116 DST=192.0.2.25 LEN=52 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=TCP SPT=50093 DPT=1443 WINDOW=2853 RES=0x00 ACK URGP=0 +Jan 5 20:17:01 MainFirewall kernel: [WAN_OUT-2000-A]IN=eth0 OUT=eth2 MAC=90:10:20:76:8d:20:90:10:65:29:b6:2a:08:00 SRC=192.168.110.116 DST=192.0.2.25 LEN=52 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=TCP SPT=50093 DPT=1443 WINDOW=2850 RES=0x00 ACK URGP=0 \ No newline at end of file diff --git a/packages/journald/data_stream/log/_dev/test/pipeline/test-iptables-raw.log-config.yml b/packages/journald/data_stream/log/_dev/test/pipeline/test-iptables-raw.log-config.yml new file mode 100644 index 000000000000..4a5d4e3f14ab --- /dev/null +++ b/packages/journald/data_stream/log/_dev/test/pipeline/test-iptables-raw.log-config.yml @@ -0,0 +1,6 @@ +dynamic_fields: + event.ingested: "^.*$" + "@timestamp": "^[0-9]{4}(-[0-9]{2}){2}T[0-9]{2}(:[0-9]{2}){2}\\.[0-9]{3}Z$" +fields: + tags: + - preserve_original_event diff --git a/packages/journald/data_stream/log/_dev/test/pipeline/test-iptables-raw.log-expected.json b/packages/journald/data_stream/log/_dev/test/pipeline/test-iptables-raw.log-expected.json new file mode 100644 index 000000000000..9dc8b7ca3bd9 --- /dev/null +++ b/packages/journald/data_stream/log/_dev/test/pipeline/test-iptables-raw.log-expected.json @@ -0,0 +1,1509 @@ +{ + "expected": [ + { + "iptables": { + "tcp": { + "flags": [ + "ACK" + ], + "reserved_bits": 0, + "window": 2853 + }, + "ubiquiti": { + "input_zone": "wan", + "rule_set": "wan-lan", + "rule_number": "default", + "output_zone": "lan" + }, + "ether_type": 2048, + "input_device": "eth0", + "precedence_bits": 0, + "fragment_flags": [ + "DF" + ], + "length": 52, + "tos": 0, + "output_device": "", + "id": 0, + "ttl": 63 + }, + "log": { + "syslog": { + "priority": 161 + } + }, + "destination": { + "port": 443, + "mac": "90:10:20:76:8d:20", + "ip": "10.4.0.5" + }, + "rule": { + "name": "wan-lan", + "id": "default" + }, + "source": { + "geo": { + "continent_name": "Europe", + "country_name": "Spain", + "location": { + "lon": -3.684, + "lat": 40.4172 + }, + "country_iso_code": "ES" + }, + "as": { + "number": 13041, + "organization": { + "name": "Consorci de Serveis Universitaris de Catalunya" + } + }, + "port": 38842, + "mac": "90:10:65:29:b6:2a", + "ip": "158.109.0.1" + }, + "message": "Hostname kernel: [wan-lan-default-D]IN=eth0 OUT= MAC=90:10:20:76:8d:20:90:10:65:29:b6:2a:08:00 SRC=158.109.0.1 DST=10.4.0.5 LEN=52 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=TCP SPT=38842 DPT=443 WINDOW=2853 RES=0x00 ACK URGP=0", + "tags": [ + "preserve_original_event" + ], + "network": { + "type": "ipv4", + "community_id": "1:RGJPRWtru8Lg2itNyFREDvoRkNA=", + "transport": "tcp" + }, + "observer": { + "name": "Hostname", + "ingress": { + "zone": "wan" + }, + "egress": { + "zone": "lan" + } + }, + "@timestamp": "2021-10-10T07:25:12.000Z", + "ecs": { + "version": "1.11.0" + }, + "related": { + "ip": [ + "158.109.0.1", + "10.4.0.5" + ] + }, + "event": { + "action": "drop", + "ingested": "2021-06-15T20:04:36.725458094Z", + "original": "\u003c161\u003eOct 10 07:25:12 Hostname kernel: [wan-lan-default-D]IN=eth0 OUT= MAC=90:10:20:76:8d:20:90:10:65:29:b6:2a:08:00 SRC=158.109.0.1 DST=10.4.0.5 LEN=52 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=TCP SPT=38842 DPT=443 WINDOW=2853 RES=0x00 ACK URGP=0", + "type": [ + "denied", + "connection" + ], + "category": [ + "network" + ], + "kind": "event" + } + }, + { + "iptables": { + "tcp": { + "flags": [ + "ACK" + ], + "reserved_bits": 0, + "window": 2853 + }, + "ubiquiti": { + "input_zone": "wan", + "rule_set": "wan-lan", + "rule_number": "default", + "output_zone": "lan" + }, + "ether_type": 2048, + "input_device": "eth0", + "precedence_bits": 0, + "fragment_flags": [ + "DF" + ], + "length": 52, + "tos": 0, + "output_device": "", + "id": 0, + "ttl": 63 + }, + "log": { + "syslog": { + "priority": 6 + } + }, + "destination": { + "port": 443, + "mac": "90:10:20:76:8d:20", + "ip": "10.4.0.5" + }, + "rule": { + "name": "wan-lan", + "id": "default" + }, + "source": { + "geo": { + "continent_name": "Europe", + "country_name": "Spain", + "location": { + "lon": -3.684, + "lat": 40.4172 + }, + "country_iso_code": "ES" + }, + "as": { + "number": 13041, + "organization": { + "name": "Consorci de Serveis Universitaris de Catalunya" + } + }, + "port": 38842, + "mac": "90:10:65:29:b6:2a", + "ip": "158.109.0.1" + }, + "message": "Hostname kernel: [wan-lan-default-D]IN=eth0 OUT= MAC=90:10:20:76:8d:20:90:10:65:29:b6:2a:08:00 SRC=158.109.0.1 DST=10.4.0.5 LEN=52 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=TCP SPT=38842 DPT=443 WINDOW=2853 RES=0x00 ACK URGP=0", + "tags": [ + "preserve_original_event" + ], + "network": { + "type": "ipv4", + "community_id": "1:RGJPRWtru8Lg2itNyFREDvoRkNA=", + "transport": "tcp" + }, + "observer": { + "name": "Hostname", + "ingress": { + "zone": "wan" + }, + "egress": { + "zone": "lan" + } + }, + "@timestamp": "2021-03-12T14:10:18.000Z", + "ecs": { + "version": "1.11.0" + }, + "related": { + "ip": [ + "158.109.0.1", + "10.4.0.5" + ] + }, + "event": { + "action": "drop", + "ingested": "2021-06-15T20:04:36.725463865Z", + "original": "\u003c6\u003e2021-03-12T14:10:18Z Hostname kernel: [wan-lan-default-D]IN=eth0 OUT= MAC=90:10:20:76:8d:20:90:10:65:29:b6:2a:08:00 SRC=158.109.0.1 DST=10.4.0.5 LEN=52 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=TCP SPT=38842 DPT=443 WINDOW=2853 RES=0x00 ACK URGP=0", + "type": [ + "denied", + "connection" + ], + "category": [ + "network" + ], + "kind": "event" + } + }, + { + "iptables": { + "tcp": { + "flags": [ + "ACK" + ], + "reserved_bits": 0, + "window": 2853 + }, + "ubiquiti": { + "input_zone": "wan", + "rule_set": "wan-lan", + "rule_number": "default", + "output_zone": "lan" + }, + "ether_type": 2048, + "input_device": "eth0", + "precedence_bits": 0, + "fragment_flags": [ + "DF" + ], + "length": 52, + "tos": 0, + "output_device": "", + "id": 0, + "ttl": 63 + }, + "destination": { + "port": 443, + "mac": "90:10:20:76:8d:20", + "ip": "10.4.0.5" + }, + "rule": { + "name": "wan-lan", + "id": "default" + }, + "source": { + "geo": { + "continent_name": "Europe", + "country_name": "Spain", + "location": { + "lon": -3.684, + "lat": 40.4172 + }, + "country_iso_code": "ES" + }, + "as": { + "number": 13041, + "organization": { + "name": "Consorci de Serveis Universitaris de Catalunya" + } + }, + "port": 38842, + "mac": "90:10:65:29:b6:2a", + "ip": "158.109.0.1" + }, + "message": "Hostname kernel: [wan-lan-default-D]IN=eth0 OUT= MAC=90:10:20:76:8d:20:90:10:65:29:b6:2a:08:00 SRC=158.109.0.1 DST=10.4.0.5 LEN=52 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=TCP SPT=38842 DPT=443 WINDOW=2853 RES=0x00 ACK URGP=0", + "tags": [ + "preserve_original_event" + ], + "network": { + "type": "ipv4", + "community_id": "1:RGJPRWtru8Lg2itNyFREDvoRkNA=", + "transport": "tcp" + }, + "observer": { + "name": "Hostname", + "ingress": { + "zone": "wan" + }, + "egress": { + "zone": "lan" + } + }, + "@timestamp": "2021-03-12T14:10:18.000Z", + "ecs": { + "version": "1.11.0" + }, + "related": { + "ip": [ + "158.109.0.1", + "10.4.0.5" + ] + }, + "event": { + "action": "drop", + "ingested": "2021-06-15T20:04:36.725466725Z", + "original": "2021-03-12T14:10:18Z Hostname kernel: [wan-lan-default-D]IN=eth0 OUT= MAC=90:10:20:76:8d:20:90:10:65:29:b6:2a:08:00 SRC=158.109.0.1 DST=10.4.0.5 LEN=52 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=TCP SPT=38842 DPT=443 WINDOW=2853 RES=0x00 ACK URGP=0", + "type": [ + "denied", + "connection" + ], + "category": [ + "network" + ], + "kind": "event" + } + }, + { + "iptables": { + "ether_type": 2048, + "input_device": "eth0", + "precedence_bits": 0, + "length": 88, + "tos": 0, + "output_device": "", + "id": 21684, + "icmp": { + "type": 3, + "code": 3 + }, + "ttl": 118 + }, + "destination": { + "mac": "90:10:28:5f:62:24", + "ip": "192.0.2.83" + }, + "source": { + "mac": "90:10:18:5a:89:2a", + "ip": "192.0.2.71" + }, + "message": "DENY: IN=eth0 OUT= MAC=90:10:28:5f:62:24:90:10:18:5a:89:2a:08:00 SRC=192.0.2.71 DST=192.0.2.83 LEN=88 TOS=0x00 PREC=0x00 TTL=118 ID=21684 PROTO=ICMP TYPE=3 CODE=3 [SRC=192.0.2.83 DST=192.168.173.191 LEN=60 TOS=0x00 PREC=0x00 TTL=54 ID=0 DF PROTO=UDP SPT=21458 DPT=62936 LEN=40 ]", + "tags": [ + "preserve_original_event" + ], + "network": { + "type": "ipv4", + "community_id": "1:T79jBEYlbFhpnIGt2rOuzIv31hE=", + "transport": "icmp" + }, + "@timestamp": "2021-01-08T03:37:09.000Z", + "ecs": { + "version": "1.11.0" + }, + "related": { + "ip": [ + "192.0.2.71", + "192.0.2.83" + ] + }, + "event": { + "action": "deny", + "ingested": "2021-06-15T20:04:36.725469433Z", + "original": "Jan 8 03:37:09 DENY: IN=eth0 OUT= MAC=90:10:28:5f:62:24:90:10:18:5a:89:2a:08:00 SRC=192.0.2.71 DST=192.0.2.83 LEN=88 TOS=0x00 PREC=0x00 TTL=118 ID=21684 PROTO=ICMP TYPE=3 CODE=3 [SRC=192.0.2.83 DST=192.168.173.191 LEN=60 TOS=0x00 PREC=0x00 TTL=54 ID=0 DF PROTO=UDP SPT=21458 DPT=62936 LEN=40 ]", + "type": [ + "denied", + "connection" + ], + "category": [ + "network" + ], + "kind": "event" + } + }, + { + "iptables": { + "tcp": { + "flags": [ + "SYN" + ], + "reserved_bits": 0, + "window": 8192 + }, + "ether_type": 2048, + "input_device": "eth0", + "precedence_bits": 0, + "fragment_flags": [ + "DF" + ], + "length": 52, + "tos": 0, + "output_device": "", + "id": 15743, + "ttl": 115 + }, + "destination": { + "port": 445, + "mac": "90:10:35:5a:1e:3a", + "ip": "172.16.54.114" + }, + "source": { + "port": 17805, + "mac": "90:10:9e:ec:2c:71", + "ip": "203.0.113.36" + }, + "message": "example-host kernel: iptables DROP_INPUT: IN=eth0 OUT= MAC=90:10:35:5a:1e:3a:90:10:9e:ec:2c:71:08:00 SRC=203.0.113.36 DST=172.16.54.114 LEN=52 TOS=0x00 PREC=0x00 TTL=115 ID=15743 DF PROTO=TCP SPT=17805 DPT=445 WINDOW=8192 RES=0x00 SYN URGP=0 ", + "tags": [ + "preserve_original_event" + ], + "network": { + "type": "ipv4", + "community_id": "1:VD3aeZ6cGYX6uwOAUQ9NuxbobMI=", + "transport": "tcp" + }, + "observer": { + "name": "example-host" + }, + "@timestamp": "2021-01-08T03:37:09.000Z", + "ecs": { + "version": "1.11.0" + }, + "related": { + "ip": [ + "203.0.113.36", + "172.16.54.114" + ] + }, + "event": { + "action": "drop_input", + "ingested": "2021-06-15T20:04:36.725472111Z", + "original": "Jan 8 03:37:09 example-host kernel: iptables DROP_INPUT: IN=eth0 OUT= MAC=90:10:35:5a:1e:3a:90:10:9e:ec:2c:71:08:00 SRC=203.0.113.36 DST=172.16.54.114 LEN=52 TOS=0x00 PREC=0x00 TTL=115 ID=15743 DF PROTO=TCP SPT=17805 DPT=445 WINDOW=8192 RES=0x00 SYN URGP=0 ", + "type": [ + "denied", + "connection" + ], + "category": [ + "network" + ], + "kind": "event" + } + }, + { + "iptables": { + "tcp": { + "flags": [ + "SYN" + ], + "reserved_bits": 0, + "window": 1024 + }, + "ether_type": 2048, + "input_device": "eth0", + "precedence_bits": 0, + "length": 40, + "tos": 0, + "output_device": "", + "id": 17703, + "ttl": 243 + }, + "destination": { + "port": 1433, + "mac": "90:10:35:5a:1e:3a", + "ip": "172.16.54.114" + }, + "source": { + "port": 47091, + "mac": "90:10:76:e0:e2:d5", + "ip": "198.51.100.198" + }, + "message": "example-host kernel: iptables DROP_INPUT: IN=eth0 OUT= MAC=90:10:35:5a:1e:3a:90:10:76:e0:e2:d5:08:00 SRC=198.51.100.198 DST=172.16.54.114 LEN=40 TOS=0x00 PREC=0x00 TTL=243 ID=17703 PROTO=TCP SPT=47091 DPT=1433 WINDOW=1024 RES=0x00 SYN URGP=0 ", + "tags": [ + "preserve_original_event" + ], + "network": { + "type": "ipv4", + "community_id": "1:r9MnuXFtcWUKzbVQ2vXn7XSQ2Fg=", + "transport": "tcp" + }, + "observer": { + "name": "example-host" + }, + "@timestamp": "2021-01-08T03:37:57.000Z", + "ecs": { + "version": "1.11.0" + }, + "related": { + "ip": [ + "198.51.100.198", + "172.16.54.114" + ] + }, + "event": { + "action": "drop_input", + "ingested": "2021-06-15T20:04:36.725474729Z", + "original": "Jan 8 03:37:57 example-host kernel: iptables DROP_INPUT: IN=eth0 OUT= MAC=90:10:35:5a:1e:3a:90:10:76:e0:e2:d5:08:00 SRC=198.51.100.198 DST=172.16.54.114 LEN=40 TOS=0x00 PREC=0x00 TTL=243 ID=17703 PROTO=TCP SPT=47091 DPT=1433 WINDOW=1024 RES=0x00 SYN URGP=0 ", + "type": [ + "denied", + "connection" + ], + "category": [ + "network" + ], + "kind": "event" + } + }, + { + "iptables": { + "tcp": { + "flags": [ + "SYN" + ], + "reserved_bits": 0, + "window": 8192 + }, + "ether_type": 2048, + "input_device": "eth0", + "precedence_bits": 0, + "fragment_flags": [ + "DF" + ], + "length": 52, + "tos": 0, + "output_device": "", + "id": 19619, + "ttl": 115 + }, + "destination": { + "port": 445, + "mac": "90:10:35:5a:1e:3a", + "ip": "172.16.54.114" + }, + "source": { + "port": 59319, + "mac": "90:10:9e:ec:2c:71", + "ip": "203.0.113.201" + }, + "message": "example-host kernel: iptables DROP_INPUT: IN=eth0 OUT= MAC=90:10:35:5a:1e:3a:90:10:9e:ec:2c:71:08:00 SRC=203.0.113.201 DST=172.16.54.114 LEN=52 TOS=0x00 PREC=0x00 TTL=115 ID=19619 DF PROTO=TCP SPT=59319 DPT=445 WINDOW=8192 RES=0x00 SYN URGP=0 ", + "tags": [ + "preserve_original_event" + ], + "network": { + "type": "ipv4", + "community_id": "1:vgBSpDUKSSgxOm6Y52jw6tCgiN8=", + "transport": "tcp" + }, + "observer": { + "name": "example-host" + }, + "@timestamp": "2021-01-08T03:38:45.000Z", + "ecs": { + "version": "1.11.0" + }, + "related": { + "ip": [ + "203.0.113.201", + "172.16.54.114" + ] + }, + "event": { + "action": "drop_input", + "ingested": "2021-06-15T20:04:36.725477361Z", + "original": "Jan 8 03:38:45 example-host kernel: iptables DROP_INPUT: IN=eth0 OUT= MAC=90:10:35:5a:1e:3a:90:10:9e:ec:2c:71:08:00 SRC=203.0.113.201 DST=172.16.54.114 LEN=52 TOS=0x00 PREC=0x00 TTL=115 ID=19619 DF PROTO=TCP SPT=59319 DPT=445 WINDOW=8192 RES=0x00 SYN URGP=0 ", + "type": [ + "denied", + "connection" + ], + "category": [ + "network" + ], + "kind": "event" + } + }, + { + "iptables": { + "tcp": { + "flags": [ + "SYN" + ], + "reserved_bits": 0, + "window": 14600 + }, + "ether_type": 2048, + "input_device": "eth0", + "precedence_bits": 0, + "fragment_flags": [ + "DF" + ], + "length": 40, + "tos": 0, + "output_device": "", + "id": 4255, + "ttl": 240 + }, + "destination": { + "port": 80, + "mac": "90:10:35:5a:1e:3a", + "ip": "172.16.54.114" + }, + "source": { + "port": 44181, + "mac": "90:10:9e:ec:2c:71", + "ip": "203.0.113.246" + }, + "message": "example-host kernel: iptables DROP_INPUT: IN=eth0 OUT= MAC=90:10:35:5a:1e:3a:90:10:9e:ec:2c:71:08:00 SRC=203.0.113.246 DST=172.16.54.114 LEN=40 TOS=0x00 PREC=0x00 TTL=240 ID=4255 DF PROTO=TCP SPT=44181 DPT=80 WINDOW=14600 RES=0x00 SYN URGP=0 ", + "tags": [ + "preserve_original_event" + ], + "network": { + "type": "ipv4", + "community_id": "1:PCNGbo6CtVQoE5Hch+6oMfbeTP4=", + "transport": "tcp" + }, + "observer": { + "name": "example-host" + }, + "@timestamp": "2021-01-08T03:39:25.000Z", + "ecs": { + "version": "1.11.0" + }, + "related": { + "ip": [ + "203.0.113.246", + "172.16.54.114" + ] + }, + "event": { + "action": "drop_input", + "ingested": "2021-06-15T20:04:36.725480004Z", + "original": "Jan 8 03:39:25 example-host kernel: iptables DROP_INPUT: IN=eth0 OUT= MAC=90:10:35:5a:1e:3a:90:10:9e:ec:2c:71:08:00 SRC=203.0.113.246 DST=172.16.54.114 LEN=40 TOS=0x00 PREC=0x00 TTL=240 ID=4255 DF PROTO=TCP SPT=44181 DPT=80 WINDOW=14600 RES=0x00 SYN URGP=0 ", + "type": [ + "denied", + "connection" + ], + "category": [ + "network" + ], + "kind": "event" + } + }, + { + "iptables": { + "tcp": { + "flags": [ + "SYN" + ], + "reserved_bits": 0, + "window": 8192 + }, + "ether_type": 2048, + "input_device": "eth0", + "precedence_bits": 0, + "fragment_flags": [ + "DF" + ], + "length": 52, + "tos": 0, + "output_device": "", + "id": 27150, + "ttl": 110 + }, + "destination": { + "port": 445, + "mac": "90:10:35:5a:1e:3a", + "ip": "172.16.54.114" + }, + "source": { + "port": 64358, + "mac": "90:10:76:e0:e2:d5", + "ip": "203.0.113.208" + }, + "message": "example-host kernel: iptables DROP_INPUT: IN=eth0 OUT= MAC=90:10:35:5a:1e:3a:90:10:76:e0:e2:d5:08:00 SRC=203.0.113.208 DST=172.16.54.114 LEN=52 TOS=0x00 PREC=0x00 TTL=110 ID=27150 DF PROTO=TCP SPT=64358 DPT=445 WINDOW=8192 RES=0x00 SYN URGP=0 ", + "tags": [ + "preserve_original_event" + ], + "network": { + "type": "ipv4", + "community_id": "1:Wb/3DTwtWE8C20/hm2JpmBAhsro=", + "transport": "tcp" + }, + "observer": { + "name": "example-host" + }, + "@timestamp": "2021-01-08T03:40:21.000Z", + "ecs": { + "version": "1.11.0" + }, + "related": { + "ip": [ + "203.0.113.208", + "172.16.54.114" + ] + }, + "event": { + "action": "drop_input", + "ingested": "2021-06-15T20:04:36.725482632Z", + "original": "Jan 8 03:40:21 example-host kernel: iptables DROP_INPUT: IN=eth0 OUT= MAC=90:10:35:5a:1e:3a:90:10:76:e0:e2:d5:08:00 SRC=203.0.113.208 DST=172.16.54.114 LEN=52 TOS=0x00 PREC=0x00 TTL=110 ID=27150 DF PROTO=TCP SPT=64358 DPT=445 WINDOW=8192 RES=0x00 SYN URGP=0 ", + "type": [ + "denied", + "connection" + ], + "category": [ + "network" + ], + "kind": "event" + } + }, + { + "iptables": { + "tcp": { + "flags": [ + "SYN" + ], + "reserved_bits": 0, + "window": 1024 + }, + "ether_type": 2048, + "input_device": "eth0", + "precedence_bits": 0, + "length": 40, + "tos": 0, + "output_device": "", + "id": 7264, + "ttl": 242 + }, + "destination": { + "port": 445, + "mac": "90:10:35:5a:1e:3a", + "ip": "172.16.54.114" + }, + "source": { + "port": 58830, + "mac": "90:10:9e:ec:2c:71", + "ip": "198.51.100.160" + }, + "message": "example-host kernel: iptables DROP_INPUT: IN=eth0 OUT= MAC=90:10:35:5a:1e:3a:90:10:9e:ec:2c:71:08:00 SRC=198.51.100.160 DST=172.16.54.114 LEN=40 TOS=0x00 PREC=0x00 TTL=242 ID=7264 PROTO=TCP SPT=58830 DPT=445 WINDOW=1024 RES=0x00 SYN URGP=0 ", + "tags": [ + "preserve_original_event" + ], + "network": { + "type": "ipv4", + "community_id": "1:+s7vkEgPnzTAoksA2Q0gAzgymfI=", + "transport": "tcp" + }, + "observer": { + "name": "example-host" + }, + "@timestamp": "2021-01-08T03:40:25.000Z", + "ecs": { + "version": "1.11.0" + }, + "related": { + "ip": [ + "198.51.100.160", + "172.16.54.114" + ] + }, + "event": { + "action": "drop_input", + "ingested": "2021-06-15T20:04:36.725485256Z", + "original": "Jan 8 03:40:25 example-host kernel: iptables DROP_INPUT: IN=eth0 OUT= MAC=90:10:35:5a:1e:3a:90:10:9e:ec:2c:71:08:00 SRC=198.51.100.160 DST=172.16.54.114 LEN=40 TOS=0x00 PREC=0x00 TTL=242 ID=7264 PROTO=TCP SPT=58830 DPT=445 WINDOW=1024 RES=0x00 SYN URGP=0 ", + "type": [ + "denied", + "connection" + ], + "category": [ + "network" + ], + "kind": "event" + } + }, + { + "iptables": { + "tcp": { + "flags": [ + "SYN" + ], + "reserved_bits": 0, + "window": 8192 + }, + "ether_type": 2048, + "input_device": "eth0", + "precedence_bits": 0, + "fragment_flags": [ + "DF" + ], + "length": 52, + "tos": 0, + "output_device": "", + "id": 6101, + "ttl": 117 + }, + "destination": { + "port": 445, + "mac": "90:10:35:5a:1e:3a", + "ip": "172.16.54.114" + }, + "source": { + "port": 51985, + "mac": "90:10:76:e0:e2:d5", + "ip": "198.51.100.115" + }, + "message": "example-host kernel: iptables DROP_INPUT: IN=eth0 OUT= MAC=90:10:35:5a:1e:3a:90:10:76:e0:e2:d5:08:00 SRC=198.51.100.115 DST=172.16.54.114 LEN=52 TOS=0x00 PREC=0x00 TTL=117 ID=6101 DF PROTO=TCP SPT=51985 DPT=445 WINDOW=8192 RES=0x00 SYN URGP=0 ", + "tags": [ + "preserve_original_event" + ], + "network": { + "type": "ipv4", + "community_id": "1:6Pvyzf2+vqgsRxWx+eU9MXEhAFE=", + "transport": "tcp" + }, + "observer": { + "name": "example-host" + }, + "@timestamp": "2021-01-08T03:41:17.000Z", + "ecs": { + "version": "1.11.0" + }, + "related": { + "ip": [ + "198.51.100.115", + "172.16.54.114" + ] + }, + "event": { + "action": "drop_input", + "ingested": "2021-06-15T20:04:36.725487863Z", + "original": "Jan 8 03:41:17 example-host kernel: iptables DROP_INPUT: IN=eth0 OUT= MAC=90:10:35:5a:1e:3a:90:10:76:e0:e2:d5:08:00 SRC=198.51.100.115 DST=172.16.54.114 LEN=52 TOS=0x00 PREC=0x00 TTL=117 ID=6101 DF PROTO=TCP SPT=51985 DPT=445 WINDOW=8192 RES=0x00 SYN URGP=0 ", + "type": [ + "denied", + "connection" + ], + "category": [ + "network" + ], + "kind": "event" + } + }, + { + "iptables": { + "tcp": { + "flags": [ + "SYN" + ], + "reserved_bits": 0, + "window": 8192 + }, + "ether_type": 2048, + "input_device": "eth0", + "precedence_bits": 0, + "fragment_flags": [ + "DF" + ], + "length": 52, + "tos": 0, + "output_device": "", + "id": 6319, + "ttl": 45 + }, + "destination": { + "port": 445, + "mac": "90:10:35:5a:1e:3a", + "ip": "172.16.54.114" + }, + "source": { + "port": 4099, + "mac": "90:10:76:e0:e2:d5", + "ip": "198.51.100.167" + }, + "message": "example-host kernel: iptables DROP_INPUT: IN=eth0 OUT= MAC=90:10:35:5a:1e:3a:90:10:76:e0:e2:d5:08:00 SRC=198.51.100.167 DST=172.16.54.114 LEN=52 TOS=0x00 PREC=0x00 TTL=45 ID=6319 DF PROTO=TCP SPT=4099 DPT=445 WINDOW=8192 RES=0x00 SYN URGP=0 ", + "tags": [ + "preserve_original_event" + ], + "network": { + "type": "ipv4", + "community_id": "1:g+bRFDuqViJEc5vzlOapz2LPhFo=", + "transport": "tcp" + }, + "observer": { + "name": "example-host" + }, + "@timestamp": "2021-01-08T03:41:23.000Z", + "ecs": { + "version": "1.11.0" + }, + "related": { + "ip": [ + "198.51.100.167", + "172.16.54.114" + ] + }, + "event": { + "action": "drop_input", + "ingested": "2021-06-15T20:04:36.725490673Z", + "original": "Jan 8 03:41:23 example-host kernel: iptables DROP_INPUT: IN=eth0 OUT= MAC=90:10:35:5a:1e:3a:90:10:76:e0:e2:d5:08:00 SRC=198.51.100.167 DST=172.16.54.114 LEN=52 TOS=0x00 PREC=0x00 TTL=45 ID=6319 DF PROTO=TCP SPT=4099 DPT=445 WINDOW=8192 RES=0x00 SYN URGP=0 ", + "type": [ + "denied", + "connection" + ], + "category": [ + "network" + ], + "kind": "event" + } + }, + { + "iptables": { + "tcp": { + "flags": [ + "SYN" + ], + "reserved_bits": 0, + "window": 1024 + }, + "ether_type": 2048, + "input_device": "eth0", + "precedence_bits": 0, + "length": 40, + "tos": 0, + "output_device": "", + "id": 48624, + "ttl": 245 + }, + "destination": { + "port": 139, + "mac": "90:10:35:5a:1e:3a", + "ip": "172.16.54.114" + }, + "source": { + "port": 59287, + "mac": "90:10:9e:ec:2c:71", + "ip": "198.51.100.19" + }, + "message": "example-host kernel: iptables DROP_INPUT: IN=eth0 OUT= MAC=90:10:35:5a:1e:3a:90:10:9e:ec:2c:71:08:00 SRC=198.51.100.19 DST=172.16.54.114 LEN=40 TOS=0x00 PREC=0x00 TTL=245 ID=48624 PROTO=TCP SPT=59287 DPT=139 WINDOW=1024 RES=0x00 SYN URGP=0 ", + "tags": [ + "preserve_original_event" + ], + "network": { + "type": "ipv4", + "community_id": "1:a/4LVq88msR/LgVGzZeIkmlNXz4=", + "transport": "tcp" + }, + "observer": { + "name": "example-host" + }, + "@timestamp": "2021-01-08T03:43:18.000Z", + "ecs": { + "version": "1.11.0" + }, + "related": { + "ip": [ + "198.51.100.19", + "172.16.54.114" + ] + }, + "event": { + "action": "drop_input", + "ingested": "2021-06-15T20:04:36.725493307Z", + "original": "Jan 8 03:43:18 example-host kernel: iptables DROP_INPUT: IN=eth0 OUT= MAC=90:10:35:5a:1e:3a:90:10:9e:ec:2c:71:08:00 SRC=198.51.100.19 DST=172.16.54.114 LEN=40 TOS=0x00 PREC=0x00 TTL=245 ID=48624 PROTO=TCP SPT=59287 DPT=139 WINDOW=1024 RES=0x00 SYN URGP=0 ", + "type": [ + "denied", + "connection" + ], + "category": [ + "network" + ], + "kind": "event" + } + }, + { + "iptables": { + "tcp": { + "flags": [ + "SYN" + ], + "reserved_bits": 0, + "window": 65535 + }, + "ether_type": 2048, + "input_device": "eth0", + "precedence_bits": 0, + "length": 40, + "tos": 0, + "output_device": "", + "id": 54321, + "ttl": 250 + }, + "destination": { + "port": 8088, + "mac": "90:10:35:5a:1e:3a", + "ip": "172.16.54.114" + }, + "source": { + "port": 53296, + "mac": "90:10:76:e0:e2:d5", + "ip": "198.51.100.68" + }, + "message": "example-host kernel: iptables DROP_INPUT: IN=eth0 OUT= MAC=90:10:35:5a:1e:3a:90:10:76:e0:e2:d5:08:00:45:00:00:00:00 SRC=198.51.100.68 DST=172.16.54.114 LEN=40 TOS=0x00 PREC=0x00 TTL=250 ID=54321 PROTO=TCP SPT=53296 DPT=8088 WINDOW=65535 RES=0x00 SYN URGP=0 ", + "tags": [ + "preserve_original_event" + ], + "network": { + "type": "ipv4", + "community_id": "1:1l65fWlqrJCJB7vBaqSgHnJoMbQ=", + "transport": "tcp" + }, + "observer": { + "name": "example-host" + }, + "@timestamp": "2021-01-08T03:43:42.000Z", + "ecs": { + "version": "1.11.0" + }, + "related": { + "ip": [ + "198.51.100.68", + "172.16.54.114" + ] + }, + "event": { + "action": "drop_input", + "ingested": "2021-06-15T20:04:36.725495946Z", + "original": "Jan 8 03:43:42 example-host kernel: iptables DROP_INPUT: IN=eth0 OUT= MAC=90:10:35:5a:1e:3a:90:10:76:e0:e2:d5:08:00:45:00:00:00:00 SRC=198.51.100.68 DST=172.16.54.114 LEN=40 TOS=0x00 PREC=0x00 TTL=250 ID=54321 PROTO=TCP SPT=53296 DPT=8088 WINDOW=65535 RES=0x00 SYN URGP=0 ", + "type": [ + "denied", + "connection" + ], + "category": [ + "network" + ], + "kind": "event" + } + }, + { + "iptables": { + "input_device": "", + "flow_label": 868225, + "length": 104, + "tos": 0, + "output_device": "lo", + "icmp": { + "code": 0, + "id": 3427, + "type": 128, + "seq": 1 + }, + "ttl": 64 + }, + "destination": { + "ip": "2001:0db8:0000:0000:0000:0000:0000:0002" + }, + "source": { + "ip": "2001:0db8:0000:0000:0000:0000:0000:0001" + }, + "message": "ubuntu-bionic kernel: [16571.459614] IN= OUT=lo SRC=2001:0db8:0000:0000:0000:0000:0000:0001 DST=2001:0db8:0000:0000:0000:0000:0000:0002 LEN=104 TC=0 HOPLIMIT=64 FLOWLBL=868225 PROTO=ICMPv6 TYPE=128 CODE=0 ID=3427 SEQ=1 ", + "tags": [ + "preserve_original_event" + ], + "network": { + "community_id": "1:u2vMS3HiWth2lIMKHB1fjELshpQ=", + "transport": "ipv6-icmp" + }, + "observer": { + "name": "ubuntu-bionic" + }, + "@timestamp": "2021-01-22T09:05:05.000Z", + "ecs": { + "version": "1.11.0" + }, + "related": { + "ip": [ + "2001:0db8:0000:0000:0000:0000:0000:0001", + "2001:0db8:0000:0000:0000:0000:0000:0002" + ] + }, + "event": { + "ingested": "2021-06-15T20:04:36.725498569Z", + "original": "Jan 22 09:05:05 ubuntu-bionic kernel: [16571.459614] IN= OUT=lo SRC=2001:0db8:0000:0000:0000:0000:0000:0001 DST=2001:0db8:0000:0000:0000:0000:0000:0002 LEN=104 TC=0 HOPLIMIT=64 FLOWLBL=868225 PROTO=ICMPv6 TYPE=128 CODE=0 ID=3427 SEQ=1 ", + "category": [ + "network" + ], + "type": [ + "connection" + ], + "kind": "event" + } + }, + { + "iptables": { + "ether_type": 34525, + "input_device": "", + "flow_label": 0, + "length": 96, + "tos": 0, + "output_device": "enp0s3", + "icmp": { + "type": 143, + "code": 0 + }, + "ttl": 1 + }, + "destination": { + "mac": "90:10:12:34:56:78", + "ip": "ff02:0000:0000:0000:0000:0000:0000:0016" + }, + "source": { + "mac": "90:10:aa:bb:cc:dd", + "ip": "fe80:0000:0000:0000:0084:88ff:feae:790a" + }, + "message": "ubuntu-bionic kernel: [ 307.757925] IN= OUT=enp0s3 MAC=90:10:12:34:56:78:90:10:aa:bb:cc:dd:86:dd:ff:ff SRC=fe80:0000:0000:0000:0084:88ff:feae:790a DST=ff02:0000:0000:0000:0000:0000:0000:0016 LEN=96 TC=0 HOPLIMIT=1 FLOWLBL=0 PROTO=ICMPv6 TYPE=143 CODE=0 MARK=0xd4", + "tags": [ + "preserve_original_event" + ], + "network": { + "type": "ipv6", + "community_id": "1:XZrSeKYMvsI3xGPWG5JqrtsD87U=", + "transport": "ipv6-icmp" + }, + "observer": { + "name": "ubuntu-bionic" + }, + "@timestamp": "2021-01-22T10:52:34.000Z", + "ecs": { + "version": "1.11.0" + }, + "related": { + "ip": [ + "fe80:0000:0000:0000:0084:88ff:feae:790a", + "ff02:0000:0000:0000:0000:0000:0000:0016" + ] + }, + "event": { + "ingested": "2021-06-15T20:04:36.725501185Z", + "original": "Jan 22 10:52:34 ubuntu-bionic kernel: [ 307.757925] IN= OUT=enp0s3 MAC=90:10:12:34:56:78:90:10:aa:bb:cc:dd:86:dd:ff:ff SRC=fe80:0000:0000:0000:0084:88ff:feae:790a DST=ff02:0000:0000:0000:0000:0000:0000:0016 LEN=96 TC=0 HOPLIMIT=1 FLOWLBL=0 PROTO=ICMPv6 TYPE=143 CODE=0 MARK=0xd4", + "category": [ + "network" + ], + "type": [ + "connection" + ], + "kind": "event" + } + }, + { + "iptables": { + "udp": { + "length": 520 + }, + "ubiquiti": { + "rule_set": "LAN_LOCAL", + "rule_number": "default" + }, + "ether_type": 2048, + "input_device": "eth0.90", + "precedence_bits": 224, + "length": 540, + "tos": 28, + "output_device": "", + "id": 27223, + "ttl": 64 + }, + "destination": { + "port": 48689, + "mac": "90:10:92:6e:ea:a7", + "ip": "255.55.174.225" + }, + "rule": { + "name": "LAN_LOCAL", + "id": "default" + }, + "source": { + "port": 48689, + "mac": "90:10:73:ba:d6:77", + "ip": "192.168.48.137" + }, + "message": "MainFirewall kernel: [LAN_LOCAL-default-A]IN=eth0.90 OUT= MAC=90:10:92:6e:ea:a7:90:10:73:ba:d6:77:08:00:45:fc:02:1c SRC=192.168.48.137 DST=255.55.174.225 LEN=540 TOS=0x1C PREC=0xE0 TTL=64 ID=27223 PROTO=UDP SPT=48689 DPT=48689 LEN=520 ", + "tags": [ + "preserve_original_event" + ], + "network": { + "type": "ipv4", + "community_id": "1:3qoibVBmc9hsnHpP4Ms5HO6ls7Q=", + "transport": "udp" + }, + "observer": { + "name": "MainFirewall" + }, + "@timestamp": "2021-01-05T20:17:05.000Z", + "ecs": { + "version": "1.11.0" + }, + "related": { + "ip": [ + "192.168.48.137", + "255.55.174.225" + ] + }, + "event": { + "action": "accept", + "ingested": "2021-06-15T20:04:36.725510393Z", + "original": "Jan 5 20:17:05 MainFirewall kernel: [LAN_LOCAL-default-A]IN=eth0.90 OUT= MAC=90:10:92:6e:ea:a7:90:10:73:ba:d6:77:08:00:45:fc:02:1c SRC=192.168.48.137 DST=255.55.174.225 LEN=540 TOS=0x1C PREC=0xE0 TTL=64 ID=27223 PROTO=UDP SPT=48689 DPT=48689 LEN=520 ", + "type": [ + "allowed", + "connection" + ], + "category": [ + "network" + ], + "kind": "event" + } + }, + { + "iptables": { + "tcp": { + "flags": [ + "ACK", + "PSH" + ], + "reserved_bits": 0, + "window": 159 + }, + "ubiquiti": { + "rule_set": "WAN_OUT", + "rule_number": "2000" + }, + "ether_type": 2048, + "input_device": "eth0", + "precedence_bits": 0, + "fragment_flags": [ + "DF" + ], + "length": 265, + "tos": 0, + "output_device": "eth2", + "id": 51768, + "ttl": 63 + }, + "destination": { + "port": 443, + "mac": "90:10:20:76:8d:20", + "ip": "192.0.2.25" + }, + "rule": { + "name": "WAN_OUT", + "id": "2000" + }, + "source": { + "port": 43189, + "mac": "90:10:24:67:f4:89", + "ip": "192.168.134.158" + }, + "message": "MainFirewall kernel: [WAN_OUT-2000-A]IN=eth0 OUT=eth2 MAC=90:10:20:76:8d:20:90:10:24:67:f4:89:08:00 SRC=192.168.134.158 DST=192.0.2.25 LEN=265 TOS=0x00 PREC=0x00 TTL=63 ID=51768 DF PROTO=TCP SPT=43189 DPT=443 WINDOW=159 RES=0x00 ACK PSH URGP=0 ", + "tags": [ + "preserve_original_event" + ], + "network": { + "type": "ipv4", + "community_id": "1:7bPQdYPL4yePwQJZt0I1dvVXLHc=", + "transport": "tcp" + }, + "observer": { + "name": "MainFirewall" + }, + "@timestamp": "2021-01-05T20:17:01.000Z", + "ecs": { + "version": "1.11.0" + }, + "related": { + "ip": [ + "192.168.134.158", + "192.0.2.25" + ] + }, + "event": { + "action": "accept", + "ingested": "2021-06-15T20:04:36.725513330Z", + "original": "Jan 5 20:17:01 MainFirewall kernel: [WAN_OUT-2000-A]IN=eth0 OUT=eth2 MAC=90:10:20:76:8d:20:90:10:24:67:f4:89:08:00 SRC=192.168.134.158 DST=192.0.2.25 LEN=265 TOS=0x00 PREC=0x00 TTL=63 ID=51768 DF PROTO=TCP SPT=43189 DPT=443 WINDOW=159 RES=0x00 ACK PSH URGP=0 ", + "type": [ + "allowed", + "connection" + ], + "category": [ + "network" + ], + "kind": "event" + } + }, + { + "iptables": { + "tcp": { + "flags": [ + "ACK" + ], + "reserved_bits": 0, + "window": 2857 + }, + "ubiquiti": { + "input_zone": "source", + "rule_set": "source-dest", + "rule_number": "default", + "output_zone": "dest" + }, + "ether_type": 2048, + "input_device": "eth0", + "precedence_bits": 0, + "fragment_flags": [ + "DF" + ], + "length": 52, + "tos": 0, + "output_device": "eth2", + "id": 0, + "ttl": 63 + }, + "destination": { + "port": 1443, + "mac": "90:10:20:76:8d:20", + "ip": "192.0.2.25" + }, + "rule": { + "name": "source-dest", + "id": "default" + }, + "source": { + "port": 50093, + "mac": "90:10:65:29:b6:2a", + "ip": "192.168.110.116" + }, + "message": "MainFirewall kernel: [source-dest-default-D]IN=eth0 OUT=eth2 MAC=90:10:20:76:8d:20:90:10:65:29:b6:2a:08:00 SRC=192.168.110.116 DST=192.0.2.25 LEN=52 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=TCP SPT=50093 DPT=1443 WINDOW=2857 RES=0x00 ACK URGP=0 ", + "tags": [ + "preserve_original_event" + ], + "network": { + "type": "ipv4", + "community_id": "1:6BwNFzns3BNljtYZJCwhPO5Qoq0=", + "transport": "tcp" + }, + "observer": { + "name": "MainFirewall", + "ingress": { + "zone": "source" + }, + "egress": { + "zone": "dest" + } + }, + "@timestamp": "2021-01-05T20:17:01.000Z", + "ecs": { + "version": "1.11.0" + }, + "related": { + "ip": [ + "192.168.110.116", + "192.0.2.25" + ] + }, + "event": { + "action": "drop", + "ingested": "2021-06-15T20:04:36.725516021Z", + "original": "Jan 5 20:17:01 MainFirewall kernel: [source-dest-default-D]IN=eth0 OUT=eth2 MAC=90:10:20:76:8d:20:90:10:65:29:b6:2a:08:00 SRC=192.168.110.116 DST=192.0.2.25 LEN=52 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=TCP SPT=50093 DPT=1443 WINDOW=2857 RES=0x00 ACK URGP=0 ", + "type": [ + "denied", + "connection" + ], + "category": [ + "network" + ], + "kind": "event" + } + }, + { + "iptables": { + "tcp": { + "flags": [ + "ACK" + ], + "reserved_bits": 0, + "window": 2853 + }, + "ubiquiti": { + "rule_set": "WAN_OUT", + "rule_number": "2000" + }, + "ether_type": 2048, + "input_device": "eth0", + "precedence_bits": 0, + "fragment_flags": [ + "DF" + ], + "length": 52, + "tos": 0, + "output_device": "eth2", + "id": 0, + "ttl": 63 + }, + "destination": { + "port": 1443, + "mac": "90:10:20:76:8d:20", + "ip": "192.0.2.25" + }, + "rule": { + "name": "WAN_OUT", + "id": "2000" + }, + "source": { + "port": 50093, + "mac": "90:10:65:29:b6:2a", + "ip": "192.168.110.116" + }, + "message": "MainFirewall kernel: [WAN_OUT-2000-A]IN=eth0 OUT=eth2 MAC=90:10:20:76:8d:20:90:10:65:29:b6:2a:08:00 SRC=192.168.110.116 DST=192.0.2.25 LEN=52 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=TCP SPT=50093 DPT=1443 WINDOW=2853 RES=0x00 ACK URGP=0 ", + "tags": [ + "preserve_original_event" + ], + "network": { + "type": "ipv4", + "community_id": "1:6BwNFzns3BNljtYZJCwhPO5Qoq0=", + "transport": "tcp" + }, + "observer": { + "name": "MainFirewall" + }, + "@timestamp": "2021-01-05T20:17:01.000Z", + "ecs": { + "version": "1.11.0" + }, + "related": { + "ip": [ + "192.168.110.116", + "192.0.2.25" + ] + }, + "event": { + "action": "accept", + "ingested": "2021-06-15T20:04:36.725518668Z", + "original": "Jan 5 20:17:01 MainFirewall kernel: [WAN_OUT-2000-A]IN=eth0 OUT=eth2 MAC=90:10:20:76:8d:20:90:10:65:29:b6:2a:08:00 SRC=192.168.110.116 DST=192.0.2.25 LEN=52 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=TCP SPT=50093 DPT=1443 WINDOW=2853 RES=0x00 ACK URGP=0 ", + "type": [ + "allowed", + "connection" + ], + "category": [ + "network" + ], + "kind": "event" + } + }, + { + "iptables": { + "tcp": { + "flags": [ + "ACK" + ], + "reserved_bits": 0, + "window": 2850 + }, + "ubiquiti": { + "rule_set": "WAN_OUT", + "rule_number": "2000" + }, + "ether_type": 2048, + "input_device": "eth0", + "precedence_bits": 0, + "fragment_flags": [ + "DF" + ], + "length": 52, + "tos": 0, + "output_device": "eth2", + "id": 0, + "ttl": 63 + }, + "destination": { + "port": 1443, + "mac": "90:10:20:76:8d:20", + "ip": "192.0.2.25" + }, + "rule": { + "name": "WAN_OUT", + "id": "2000" + }, + "source": { + "port": 50093, + "mac": "90:10:65:29:b6:2a", + "ip": "192.168.110.116" + }, + "message": "MainFirewall kernel: [WAN_OUT-2000-A]IN=eth0 OUT=eth2 MAC=90:10:20:76:8d:20:90:10:65:29:b6:2a:08:00 SRC=192.168.110.116 DST=192.0.2.25 LEN=52 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=TCP SPT=50093 DPT=1443 WINDOW=2850 RES=0x00 ACK URGP=0 ", + "tags": [ + "preserve_original_event" + ], + "network": { + "type": "ipv4", + "community_id": "1:6BwNFzns3BNljtYZJCwhPO5Qoq0=", + "transport": "tcp" + }, + "observer": { + "name": "MainFirewall" + }, + "@timestamp": "2021-01-05T20:17:01.000Z", + "ecs": { + "version": "1.11.0" + }, + "related": { + "ip": [ + "192.168.110.116", + "192.0.2.25" + ] + }, + "event": { + "action": "accept", + "ingested": "2021-06-15T20:04:36.725521297Z", + "original": "Jan 5 20:17:01 MainFirewall kernel: [WAN_OUT-2000-A]IN=eth0 OUT=eth2 MAC=90:10:20:76:8d:20:90:10:65:29:b6:2a:08:00 SRC=192.168.110.116 DST=192.0.2.25 LEN=52 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=TCP SPT=50093 DPT=1443 WINDOW=2850 RES=0x00 ACK URGP=0 ", + "type": [ + "allowed", + "connection" + ], + "category": [ + "network" + ], + "kind": "event" + } + } + ] +} \ No newline at end of file diff --git a/packages/journald/data_stream/log/_dev/test/pipeline/test-ubiquiti.log b/packages/journald/data_stream/log/_dev/test/pipeline/test-ubiquiti.log new file mode 100644 index 000000000000..b15c3a33a65a --- /dev/null +++ b/packages/journald/data_stream/log/_dev/test/pipeline/test-ubiquiti.log @@ -0,0 +1,11 @@ +Jan 5 20:17:05 MainFirewall kernel: [LAN_LOCAL-default-A]IN=eth0.90 OUT= MAC=90:10:92:6e:ea:a7:90:10:73:ba:d6:77:08:00:45:fc:02:1c SRC=192.168.48.137 DST=255.55.174.225 LEN=540 TOS=0x1C PREC=0xE0 TTL=64 ID=27223 PROTO=UDP SPT=48689 DPT=48689 LEN=520 +Jan 5 20:17:01 MainFirewall kernel: [WAN_OUT-2000-A]IN=eth0 OUT=eth2 MAC=90:10:20:76:8d:20:90:10:24:67:f4:89:08:00 SRC=192.168.134.158 DST=192.0.2.25 LEN=265 TOS=0x00 PREC=0x00 TTL=63 ID=51768 DF PROTO=TCP SPT=43189 DPT=443 WINDOW=159 RES=0x00 ACK PSH URGP=0 +Jan 5 20:17:01 MainFirewall kernel: [source-dest-default-D]IN=eth0 OUT=eth2 MAC=90:10:20:76:8d:20:90:10:65:29:b6:2a:08:00 SRC=192.168.110.116 DST=192.0.2.25 LEN=52 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=TCP SPT=50093 DPT=1443 WINDOW=2857 RES=0x00 ACK URGP=0 +Jan 5 20:17:01 MainFirewall kernel: [WAN_OUT-2000-A]IN=eth0 OUT=eth2 MAC=90:10:20:76:8d:20:90:10:65:29:b6:2a:08:00 SRC=192.168.110.116 DST=192.0.2.25 LEN=52 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=TCP SPT=50093 DPT=1443 WINDOW=2853 RES=0x00 ACK URGP=0 +Jan 5 20:17:01 MainFirewall kernel: [WAN_OUT-2000-A]IN=eth0 OUT=eth2 MAC=90:10:20:76:8d:20:90:10:65:29:b6:2a:08:00 SRC=192.168.110.116 DST=192.0.2.25 LEN=52 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=TCP SPT=50093 DPT=1443 WINDOW=2850 RES=0x00 ACK URGP=0 +May 5 20:46:45 My-Office-Gateway user.info kernel: TTL=126 ID=15317 DF PROTO=TCP SPT=59344 DPT=443 WINDOW=8212 RES=0x00 ACK PSH URGP=0 +May 5 20:46:46 My-Office-Gateway user.info kernel: TTL=126 ID=51392 DF PROTO=TCP SPT=51653 DPT=7914 WINDOW=1024 RES=0x00 ACK PSH URGP=0 +May 5 20:46:46 My-Office-Gateway user.info kernel: L=126 ID=8698 DF PROTO=TCP SPT=88 DPT=51179 WINDOW=2053 RES=0x00 ACK URGP=0 +May 5 20:47:09 My-Office-Gateway user.info kernel: 0 TTL=126 ID=15461 DF PROTO=TCP SPT=59289 DPT=443 WINDOW=8208 RES=0x00 ACK PSH URGP=0 +May 5 20:46:56 My-Office-Gateway user.info kernel: L=126 ID=8702 DF PROTO=TCP SPT=88 DPT=51182 WINDOW=2053 RES=0x00 ACK URGP=0 +May 5 20:45:44 My-Office-Gateway user.info kernel: TL=126 ID=4622 DF PROTO=TCP SPT=389 DPT=49209 WINDOW=8192 RES=0x00 ECE ACK SYN URGP=0 diff --git a/packages/journald/data_stream/log/_dev/test/pipeline/test-ubiquiti.log-config.yml b/packages/journald/data_stream/log/_dev/test/pipeline/test-ubiquiti.log-config.yml new file mode 100644 index 000000000000..4a5d4e3f14ab --- /dev/null +++ b/packages/journald/data_stream/log/_dev/test/pipeline/test-ubiquiti.log-config.yml @@ -0,0 +1,6 @@ +dynamic_fields: + event.ingested: "^.*$" + "@timestamp": "^[0-9]{4}(-[0-9]{2}){2}T[0-9]{2}(:[0-9]{2}){2}\\.[0-9]{3}Z$" +fields: + tags: + - preserve_original_event diff --git a/packages/journald/data_stream/log/_dev/test/pipeline/test-ubiquiti.log-expected.json b/packages/journald/data_stream/log/_dev/test/pipeline/test-ubiquiti.log-expected.json new file mode 100644 index 000000000000..24e4c8503661 --- /dev/null +++ b/packages/journald/data_stream/log/_dev/test/pipeline/test-ubiquiti.log-expected.json @@ -0,0 +1,632 @@ +{ + "expected": [ + { + "iptables": { + "udp": { + "length": 520 + }, + "ubiquiti": { + "rule_set": "LAN_LOCAL", + "rule_number": "default" + }, + "ether_type": 2048, + "input_device": "eth0.90", + "precedence_bits": 224, + "length": 540, + "tos": 28, + "output_device": "", + "id": 27223, + "ttl": 64 + }, + "destination": { + "port": 48689, + "mac": "90:10:92:6e:ea:a7", + "ip": "255.55.174.225" + }, + "rule": { + "name": "LAN_LOCAL", + "id": "default" + }, + "source": { + "port": 48689, + "mac": "90:10:73:ba:d6:77", + "ip": "192.168.48.137" + }, + "message": "MainFirewall kernel: [LAN_LOCAL-default-A]IN=eth0.90 OUT= MAC=90:10:92:6e:ea:a7:90:10:73:ba:d6:77:08:00:45:fc:02:1c SRC=192.168.48.137 DST=255.55.174.225 LEN=540 TOS=0x1C PREC=0xE0 TTL=64 ID=27223 PROTO=UDP SPT=48689 DPT=48689 LEN=520", + "tags": [ + "preserve_original_event" + ], + "network": { + "type": "ipv4", + "community_id": "1:3qoibVBmc9hsnHpP4Ms5HO6ls7Q=", + "transport": "udp" + }, + "observer": { + "name": "MainFirewall" + }, + "@timestamp": "2021-01-05T20:17:05.000Z", + "ecs": { + "version": "1.11.0" + }, + "related": { + "ip": [ + "192.168.48.137", + "255.55.174.225" + ] + }, + "event": { + "action": "accept", + "ingested": "2021-06-15T20:04:38.320846840Z", + "original": "Jan 5 20:17:05 MainFirewall kernel: [LAN_LOCAL-default-A]IN=eth0.90 OUT= MAC=90:10:92:6e:ea:a7:90:10:73:ba:d6:77:08:00:45:fc:02:1c SRC=192.168.48.137 DST=255.55.174.225 LEN=540 TOS=0x1C PREC=0xE0 TTL=64 ID=27223 PROTO=UDP SPT=48689 DPT=48689 LEN=520", + "type": [ + "allowed", + "connection" + ], + "category": [ + "network" + ], + "kind": "event" + } + }, + { + "iptables": { + "tcp": { + "flags": [ + "ACK", + "PSH" + ], + "reserved_bits": 0, + "window": 159 + }, + "ubiquiti": { + "rule_set": "WAN_OUT", + "rule_number": "2000" + }, + "ether_type": 2048, + "input_device": "eth0", + "precedence_bits": 0, + "fragment_flags": [ + "DF" + ], + "length": 265, + "tos": 0, + "output_device": "eth2", + "id": 51768, + "ttl": 63 + }, + "destination": { + "port": 443, + "mac": "90:10:20:76:8d:20", + "ip": "192.0.2.25" + }, + "rule": { + "name": "WAN_OUT", + "id": "2000" + }, + "source": { + "port": 43189, + "mac": "90:10:24:67:f4:89", + "ip": "192.168.134.158" + }, + "message": "MainFirewall kernel: [WAN_OUT-2000-A]IN=eth0 OUT=eth2 MAC=90:10:20:76:8d:20:90:10:24:67:f4:89:08:00 SRC=192.168.134.158 DST=192.0.2.25 LEN=265 TOS=0x00 PREC=0x00 TTL=63 ID=51768 DF PROTO=TCP SPT=43189 DPT=443 WINDOW=159 RES=0x00 ACK PSH URGP=0", + "tags": [ + "preserve_original_event" + ], + "network": { + "type": "ipv4", + "community_id": "1:7bPQdYPL4yePwQJZt0I1dvVXLHc=", + "transport": "tcp" + }, + "observer": { + "name": "MainFirewall" + }, + "@timestamp": "2021-01-05T20:17:01.000Z", + "ecs": { + "version": "1.11.0" + }, + "related": { + "ip": [ + "192.168.134.158", + "192.0.2.25" + ] + }, + "event": { + "action": "accept", + "ingested": "2021-06-15T20:04:38.320852629Z", + "original": "Jan 5 20:17:01 MainFirewall kernel: [WAN_OUT-2000-A]IN=eth0 OUT=eth2 MAC=90:10:20:76:8d:20:90:10:24:67:f4:89:08:00 SRC=192.168.134.158 DST=192.0.2.25 LEN=265 TOS=0x00 PREC=0x00 TTL=63 ID=51768 DF PROTO=TCP SPT=43189 DPT=443 WINDOW=159 RES=0x00 ACK PSH URGP=0", + "type": [ + "allowed", + "connection" + ], + "category": [ + "network" + ], + "kind": "event" + } + }, + { + "iptables": { + "tcp": { + "flags": [ + "ACK" + ], + "reserved_bits": 0, + "window": 2857 + }, + "ubiquiti": { + "input_zone": "source", + "rule_set": "source-dest", + "rule_number": "default", + "output_zone": "dest" + }, + "ether_type": 2048, + "input_device": "eth0", + "precedence_bits": 0, + "fragment_flags": [ + "DF" + ], + "length": 52, + "tos": 0, + "output_device": "eth2", + "id": 0, + "ttl": 63 + }, + "destination": { + "port": 1443, + "mac": "90:10:20:76:8d:20", + "ip": "192.0.2.25" + }, + "rule": { + "name": "source-dest", + "id": "default" + }, + "source": { + "port": 50093, + "mac": "90:10:65:29:b6:2a", + "ip": "192.168.110.116" + }, + "message": "MainFirewall kernel: [source-dest-default-D]IN=eth0 OUT=eth2 MAC=90:10:20:76:8d:20:90:10:65:29:b6:2a:08:00 SRC=192.168.110.116 DST=192.0.2.25 LEN=52 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=TCP SPT=50093 DPT=1443 WINDOW=2857 RES=0x00 ACK URGP=0", + "tags": [ + "preserve_original_event" + ], + "network": { + "type": "ipv4", + "community_id": "1:6BwNFzns3BNljtYZJCwhPO5Qoq0=", + "transport": "tcp" + }, + "observer": { + "name": "MainFirewall", + "ingress": { + "zone": "source" + }, + "egress": { + "zone": "dest" + } + }, + "@timestamp": "2021-01-05T20:17:01.000Z", + "ecs": { + "version": "1.11.0" + }, + "related": { + "ip": [ + "192.168.110.116", + "192.0.2.25" + ] + }, + "event": { + "action": "drop", + "ingested": "2021-06-15T20:04:38.320855475Z", + "original": "Jan 5 20:17:01 MainFirewall kernel: [source-dest-default-D]IN=eth0 OUT=eth2 MAC=90:10:20:76:8d:20:90:10:65:29:b6:2a:08:00 SRC=192.168.110.116 DST=192.0.2.25 LEN=52 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=TCP SPT=50093 DPT=1443 WINDOW=2857 RES=0x00 ACK URGP=0", + "type": [ + "denied", + "connection" + ], + "category": [ + "network" + ], + "kind": "event" + } + }, + { + "iptables": { + "tcp": { + "flags": [ + "ACK" + ], + "reserved_bits": 0, + "window": 2853 + }, + "ubiquiti": { + "rule_set": "WAN_OUT", + "rule_number": "2000" + }, + "ether_type": 2048, + "input_device": "eth0", + "precedence_bits": 0, + "fragment_flags": [ + "DF" + ], + "length": 52, + "tos": 0, + "output_device": "eth2", + "id": 0, + "ttl": 63 + }, + "destination": { + "port": 1443, + "mac": "90:10:20:76:8d:20", + "ip": "192.0.2.25" + }, + "rule": { + "name": "WAN_OUT", + "id": "2000" + }, + "source": { + "port": 50093, + "mac": "90:10:65:29:b6:2a", + "ip": "192.168.110.116" + }, + "message": "MainFirewall kernel: [WAN_OUT-2000-A]IN=eth0 OUT=eth2 MAC=90:10:20:76:8d:20:90:10:65:29:b6:2a:08:00 SRC=192.168.110.116 DST=192.0.2.25 LEN=52 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=TCP SPT=50093 DPT=1443 WINDOW=2853 RES=0x00 ACK URGP=0", + "tags": [ + "preserve_original_event" + ], + "network": { + "type": "ipv4", + "community_id": "1:6BwNFzns3BNljtYZJCwhPO5Qoq0=", + "transport": "tcp" + }, + "observer": { + "name": "MainFirewall" + }, + "@timestamp": "2021-01-05T20:17:01.000Z", + "ecs": { + "version": "1.11.0" + }, + "related": { + "ip": [ + "192.168.110.116", + "192.0.2.25" + ] + }, + "event": { + "action": "accept", + "ingested": "2021-06-15T20:04:38.320863506Z", + "original": "Jan 5 20:17:01 MainFirewall kernel: [WAN_OUT-2000-A]IN=eth0 OUT=eth2 MAC=90:10:20:76:8d:20:90:10:65:29:b6:2a:08:00 SRC=192.168.110.116 DST=192.0.2.25 LEN=52 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=TCP SPT=50093 DPT=1443 WINDOW=2853 RES=0x00 ACK URGP=0", + "type": [ + "allowed", + "connection" + ], + "category": [ + "network" + ], + "kind": "event" + } + }, + { + "iptables": { + "tcp": { + "flags": [ + "ACK" + ], + "reserved_bits": 0, + "window": 2850 + }, + "ubiquiti": { + "rule_set": "WAN_OUT", + "rule_number": "2000" + }, + "ether_type": 2048, + "input_device": "eth0", + "precedence_bits": 0, + "fragment_flags": [ + "DF" + ], + "length": 52, + "tos": 0, + "output_device": "eth2", + "id": 0, + "ttl": 63 + }, + "destination": { + "port": 1443, + "mac": "90:10:20:76:8d:20", + "ip": "192.0.2.25" + }, + "rule": { + "name": "WAN_OUT", + "id": "2000" + }, + "source": { + "port": 50093, + "mac": "90:10:65:29:b6:2a", + "ip": "192.168.110.116" + }, + "message": "MainFirewall kernel: [WAN_OUT-2000-A]IN=eth0 OUT=eth2 MAC=90:10:20:76:8d:20:90:10:65:29:b6:2a:08:00 SRC=192.168.110.116 DST=192.0.2.25 LEN=52 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=TCP SPT=50093 DPT=1443 WINDOW=2850 RES=0x00 ACK URGP=0", + "tags": [ + "preserve_original_event" + ], + "network": { + "type": "ipv4", + "community_id": "1:6BwNFzns3BNljtYZJCwhPO5Qoq0=", + "transport": "tcp" + }, + "observer": { + "name": "MainFirewall" + }, + "@timestamp": "2021-01-05T20:17:01.000Z", + "ecs": { + "version": "1.11.0" + }, + "related": { + "ip": [ + "192.168.110.116", + "192.0.2.25" + ] + }, + "event": { + "action": "accept", + "ingested": "2021-06-15T20:04:38.320866951Z", + "original": "Jan 5 20:17:01 MainFirewall kernel: [WAN_OUT-2000-A]IN=eth0 OUT=eth2 MAC=90:10:20:76:8d:20:90:10:65:29:b6:2a:08:00 SRC=192.168.110.116 DST=192.0.2.25 LEN=52 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=TCP SPT=50093 DPT=1443 WINDOW=2850 RES=0x00 ACK URGP=0", + "type": [ + "allowed", + "connection" + ], + "category": [ + "network" + ], + "kind": "event" + } + }, + { + "iptables": { + "tcp": { + "flags": [ + "ACK", + "PSH" + ], + "reserved_bits": 0, + "window": 8212 + }, + "ttl": 126, + "id": 15317 + }, + "destination": { + "port": 443 + }, + "source": { + "port": 59344 + }, + "message": "My-Office-Gateway user.info kernel: TTL=126 ID=15317 DF PROTO=TCP SPT=59344 DPT=443 WINDOW=8212 RES=0x00 ACK PSH URGP=0", + "tags": [ + "preserve_original_event" + ], + "network": { + "transport": "tcp" + }, + "observer": { + "name": "My-Office-Gateway" + }, + "@timestamp": "2021-05-05T20:46:45.000Z", + "ecs": { + "version": "1.11.0" + }, + "event": { + "ingested": "2021-06-15T20:04:38.320869594Z", + "original": "May 5 20:46:45 My-Office-Gateway user.info kernel: TTL=126 ID=15317 DF PROTO=TCP SPT=59344 DPT=443 WINDOW=8212 RES=0x00 ACK PSH URGP=0", + "category": [ + "network" + ], + "kind": "event" + } + }, + { + "iptables": { + "tcp": { + "flags": [ + "ACK", + "PSH" + ], + "reserved_bits": 0, + "window": 1024 + }, + "ttl": 126, + "id": 51392 + }, + "destination": { + "port": 7914 + }, + "source": { + "port": 51653 + }, + "message": "My-Office-Gateway user.info kernel: TTL=126 ID=51392 DF PROTO=TCP SPT=51653 DPT=7914 WINDOW=1024 RES=0x00 ACK PSH URGP=0", + "tags": [ + "preserve_original_event" + ], + "network": { + "transport": "tcp" + }, + "observer": { + "name": "My-Office-Gateway" + }, + "@timestamp": "2021-05-05T20:46:46.000Z", + "ecs": { + "version": "1.11.0" + }, + "event": { + "ingested": "2021-06-15T20:04:38.320872209Z", + "original": "May 5 20:46:46 My-Office-Gateway user.info kernel: TTL=126 ID=51392 DF PROTO=TCP SPT=51653 DPT=7914 WINDOW=1024 RES=0x00 ACK PSH URGP=0", + "category": [ + "network" + ], + "kind": "event" + } + }, + { + "iptables": { + "tcp": { + "flags": [ + "ACK" + ], + "reserved_bits": 0, + "window": 2053 + }, + "ttl": 126, + "id": 8698 + }, + "destination": { + "port": 51179 + }, + "source": { + "port": 88 + }, + "message": "My-Office-Gateway user.info kernel: L=126 ID=8698 DF PROTO=TCP SPT=88 DPT=51179 WINDOW=2053 RES=0x00 ACK URGP=0", + "tags": [ + "preserve_original_event" + ], + "network": { + "transport": "tcp" + }, + "observer": { + "name": "My-Office-Gateway" + }, + "@timestamp": "2021-05-05T20:46:46.000Z", + "ecs": { + "version": "1.11.0" + }, + "event": { + "ingested": "2021-06-15T20:04:38.320874900Z", + "original": "May 5 20:46:46 My-Office-Gateway user.info kernel: L=126 ID=8698 DF PROTO=TCP SPT=88 DPT=51179 WINDOW=2053 RES=0x00 ACK URGP=0", + "category": [ + "network" + ], + "kind": "event" + } + }, + { + "iptables": { + "tcp": { + "flags": [ + "ACK", + "PSH" + ], + "reserved_bits": 0, + "window": 8208 + }, + "ttl": 126, + "id": 15461 + }, + "destination": { + "port": 443 + }, + "source": { + "port": 59289 + }, + "message": "My-Office-Gateway user.info kernel: 0 TTL=126 ID=15461 DF PROTO=TCP SPT=59289 DPT=443 WINDOW=8208 RES=0x00 ACK PSH URGP=0", + "tags": [ + "preserve_original_event" + ], + "network": { + "transport": "tcp" + }, + "observer": { + "name": "My-Office-Gateway" + }, + "@timestamp": "2021-05-05T20:47:09.000Z", + "ecs": { + "version": "1.11.0" + }, + "event": { + "ingested": "2021-06-15T20:04:38.320883074Z", + "original": "May 5 20:47:09 My-Office-Gateway user.info kernel: 0 TTL=126 ID=15461 DF PROTO=TCP SPT=59289 DPT=443 WINDOW=8208 RES=0x00 ACK PSH URGP=0", + "category": [ + "network" + ], + "kind": "event" + } + }, + { + "iptables": { + "tcp": { + "flags": [ + "ACK" + ], + "reserved_bits": 0, + "window": 2053 + }, + "ttl": 126, + "id": 8702 + }, + "destination": { + "port": 51182 + }, + "source": { + "port": 88 + }, + "message": "My-Office-Gateway user.info kernel: L=126 ID=8702 DF PROTO=TCP SPT=88 DPT=51182 WINDOW=2053 RES=0x00 ACK URGP=0", + "tags": [ + "preserve_original_event" + ], + "network": { + "transport": "tcp" + }, + "observer": { + "name": "My-Office-Gateway" + }, + "@timestamp": "2021-05-05T20:46:56.000Z", + "ecs": { + "version": "1.11.0" + }, + "event": { + "ingested": "2021-06-15T20:04:38.320885826Z", + "original": "May 5 20:46:56 My-Office-Gateway user.info kernel: L=126 ID=8702 DF PROTO=TCP SPT=88 DPT=51182 WINDOW=2053 RES=0x00 ACK URGP=0", + "category": [ + "network" + ], + "kind": "event" + } + }, + { + "iptables": { + "tcp": { + "flags": [ + "ECE", + "ACK", + "SYN" + ], + "reserved_bits": 0, + "window": 8192 + }, + "ttl": 126, + "id": 4622 + }, + "destination": { + "port": 49209 + }, + "source": { + "port": 389 + }, + "message": "My-Office-Gateway user.info kernel: TL=126 ID=4622 DF PROTO=TCP SPT=389 DPT=49209 WINDOW=8192 RES=0x00 ECE ACK SYN URGP=0", + "tags": [ + "preserve_original_event" + ], + "network": { + "transport": "tcp" + }, + "observer": { + "name": "My-Office-Gateway" + }, + "@timestamp": "2021-05-05T20:45:44.000Z", + "ecs": { + "version": "1.11.0" + }, + "event": { + "ingested": "2021-06-15T20:04:38.320888483Z", + "original": "May 5 20:45:44 My-Office-Gateway user.info kernel: TL=126 ID=4622 DF PROTO=TCP SPT=389 DPT=49209 WINDOW=8192 RES=0x00 ECE ACK SYN URGP=0", + "category": [ + "network" + ], + "kind": "event" + } + } + ] +} \ No newline at end of file diff --git a/packages/journald/data_stream/log/_dev/test/system/test-journald-config.yml b/packages/journald/data_stream/log/_dev/test/system/test-journald-config.yml new file mode 100644 index 000000000000..a7b24e6615b4 --- /dev/null +++ b/packages/journald/data_stream/log/_dev/test/system/test-journald-config.yml @@ -0,0 +1,7 @@ +service: journald +input: journald +data_stream: + vars: + paths: + - "{{SERVICE_LOGS_DIR}}/test.journal" + tags: [forwarded] diff --git a/packages/journald/data_stream/log/agent/stream/journald.yml.hbs b/packages/journald/data_stream/log/agent/stream/journald.yml.hbs new file mode 100644 index 000000000000..9cc602ea857d --- /dev/null +++ b/packages/journald/data_stream/log/agent/stream/journald.yml.hbs @@ -0,0 +1,29 @@ +condition: ${host.platform} == 'linux' + +{{#if paths}} +paths: +{{#each paths as |path i|}} + - {{path}} +{{/each}} +{{/if}} + +{{#if include_matches}} +include_matches: +{{#each include_matches as |include_match i|}} + - '{{include_match}}' +{{/each}} +{{/if}} + +tags: +{{#each tags as |tag i|}} + - {{tag}} +{{/each}} + +{{#contains tags "forwarded"}} +publisher_pipeline.disable_host: true +{{/contains}} + +{{#if processors}} +processors: +{{processors}} +{{/if}} diff --git a/packages/journald/data_stream/log/elasticsearch/ingest_pipeline/default.yml b/packages/journald/data_stream/log/elasticsearch/ingest_pipeline/default.yml new file mode 100644 index 000000000000..07587b8c055e --- /dev/null +++ b/packages/journald/data_stream/log/elasticsearch/ingest_pipeline/default.yml @@ -0,0 +1,54 @@ +--- +description: Pipeline for processing journald logs. +processors: + - remove: + field: + - container.id_truncated # CONTAINER_ID from journald driver. + - log.syslog.facility.name # Duplicated as syslog.facility. + - syslog.priority # Duplicated as log.syslog.priority. + ignore_missing: true + + # Journald _CAP_EFFECTIVE. + # There is a typo in the field name from the input. + - rename: + field: journald.process.capabilites + target_field: journald.process.capabilities + ignore_missing: true + + # Journald CODE_FILE, CODE_LINE, CODE_FUNC. + - rename: + field: journald.code.file + target_field: log.origin.file.name + ignore_missing: true + - rename: + field: journald.code.line + target_field: log.origin.file.line + ignore_missing: true + - rename: + field: journald.code.func + target_field: log.origin.function + ignore_missing: true + + # Journald SYSLOG_FACILITY, SYSLOG_IDENTIFIER, SYSLOG_PID. + - rename: + field: syslog.pid + target_field: log.syslog.pid + ignore_missing: true + - rename: + field: syslog.identifier + target_field: log.syslog.identifier + ignore_missing: true + - rename: + field: syslog.facility + target_field: log.syslog.facility.code + ignore_missing: true + + # Cleanup an empty syslog object. + - remove: + if: ctx?.syslog != null && ctx.syslog instanceof Map && ctx.syslog.isEmpty() + field: syslog + +on_failure: +- set: + field: error.message + value: '{{ _ingest.on_failure_message }}' \ No newline at end of file diff --git a/packages/journald/data_stream/log/fields/agent.yml b/packages/journald/data_stream/log/fields/agent.yml new file mode 100644 index 000000000000..051c104fae2e --- /dev/null +++ b/packages/journald/data_stream/log/fields/agent.yml @@ -0,0 +1,2 @@ +- name: input.type + type: keyword diff --git a/packages/journald/data_stream/log/fields/base-fields.yml b/packages/journald/data_stream/log/fields/base-fields.yml new file mode 100644 index 000000000000..7c798f4534ca --- /dev/null +++ b/packages/journald/data_stream/log/fields/base-fields.yml @@ -0,0 +1,12 @@ +- name: data_stream.type + type: constant_keyword + description: Data stream type. +- name: data_stream.dataset + type: constant_keyword + description: Data stream dataset. +- name: data_stream.namespace + type: constant_keyword + description: Data stream namespace. +- name: '@timestamp' + type: date + description: Event timestamp. diff --git a/packages/journald/data_stream/log/fields/ecs.yml b/packages/journald/data_stream/log/fields/ecs.yml new file mode 100644 index 000000000000..1b6dd97fbf95 --- /dev/null +++ b/packages/journald/data_stream/log/fields/ecs.yml @@ -0,0 +1,22 @@ +- name: ecs.version + external: ecs +- name: log.syslog.facility.code + external: ecs +- name: log.syslog.priority + external: ecs +- name: message + external: ecs +- name: process.args + external: ecs +- name: process.args_count + external: ecs +- name: process.command_line + external: ecs +- name: process.pid + external: ecs +- name: tags + external: ecs +- name: user.group.id + external: ecs +- name: user.id + external: ecs diff --git a/packages/journald/data_stream/log/fields/input.yml b/packages/journald/data_stream/log/fields/input.yml new file mode 100644 index 000000000000..99b92016644d --- /dev/null +++ b/packages/journald/data_stream/log/fields/input.yml @@ -0,0 +1,204 @@ +- name: container.log.tag + type: keyword + description: > + User defined tag of a container. Originates from the Docker journald logging driver. + +- name: container.partial + type: boolean + description: > + A field that flags log integrity when a message is split. The docker journald logging driver splits long message into multiple events. + +- name: host.hostname + type: keyword + description: > + The name of the originating host (from journald). + +- name: host.id + type: keyword + description: > + The machine ID of the originating host (from `machine-id`). + +- name: journald.audit.login_uid + type: long + description: > + The login UID of the process the journal entry originates from, as maintained by the kernel audit subsystem. + +- name: journald.audit.session + type: keyword + description: > + The session of the process the journal entry originates from, as maintained by the kernel audit subsystem. + +- name: journald.code.file + type: keyword + description: > + The code location generating this message, if known. Contains the source filename. + +- name: journald.code.func + type: keyword + description: > + The code location generating this message, if known. Contains the function name. + +- name: journald.code.line + type: long + description: > + The code location generating this message, if known. Contains the line number. + +- name: journald.coredump.unit + type: keyword + description: > + Used to annotate messages containing coredumps from system units. + +- name: journald.coredump.user_unit + type: keyword + description: > + Used to annotate messages containing coredumps from user units. + +- name: journald.gid + type: long + description: > + The group ID of the process the journal entry originates from formatted as a decimal string. Note that entries obtained via "stdout" or "stderr" of forked processes will contain credentials valid for a parent process. + +- name: journald.host.boot_id + type: keyword + description: > + The kernel boot ID for the boot the message was generated in, formatted as a 128-bit hexadecimal string. + +- name: journald.kernel.device + type: keyword + description: > + The kernel device name. If the entry is associated to a block device, contains the major and minor numbers of the device node, separated by ":" and prefixed by "b". Similarly for character devices, but prefixed by "c". For network devices, this is the interface index prefixed by "n". For all other devices, this is the subsystem name prefixed by "+", followed by ":", followed by the kernel device name. + +- name: journald.kernel.device_name + type: keyword + description: > + The kernel device name as it shows up in the device tree below `/sys/`. + +- name: journald.kernel.device_node_path + type: keyword + description: > + The device node path of this device in `/dev/`. + +- name: journald.kernel.device_symlinks + type: keyword + description: > + Additional symlink names pointing to the device node in `/dev/`. This field is frequently set more than once per entry. + +- name: journald.kernel.subsystem + type: keyword + description: > + The kernel subsystem name. + +- name: journald.object.pid + type: long + description: > + Privileged programs (currently UID 0) may attach OBJECT_PID= to a message. This will instruct systemd-journald to attach additional `journald.object.*` on behalf of the caller. These additional fields added automatically by systemd-journald. These additional `journald.object.*` fields are the same as the equivalent `journald.*` field except that the process identified by PID is described, instead of the process which logged the message. + +- name: journald.object.audit.login_uid + type: long +- name: journald.object.audit.session + type: long +- name: journald.object.gid + type: long +- name: journald.object.process.command_line + type: keyword +- name: journald.object.process.executable + type: keyword +- name: journald.object.process.name + type: keyword +- name: journald.object.systemd.owner_uid + type: long +- name: journald.object.systemd.session + type: keyword +- name: journald.object.systemd.unit + type: keyword +- name: journald.object.systemd.user_unit + type: keyword +- name: journald.object.uid + type: long +- name: journald.pid + type: long + description: > + The process ID of the process the journal entry originates from formatted as a decimal string. Note that entries obtained via "stdout" or "stderr" of forked processes will contain credentials valid for a parent process. + +- name: journald.process.capabilities + type: keyword + description: The effective capabilities(7) of the process the journal entry originates from. +- name: journald.process.command_line + type: keyword + description: > + The command line of the process the journal entry originates from. + +- name: journald.process.executable + type: keyword + description: > + The executable path of the process the journal entry originates from. + +- name: journald.process.name + type: keyword + description: > + The name of the process the journal entry originates from. + +- name: journald.uid + type: long + description: > + The user ID of the process the journal entry originates from formatted as a decimal string. Note that entries obtained via "stdout" or "stderr" of forked processes will contain credentials valid for a parent process. + +- name: log.syslog.identifier + type: keyword + description: > + Identifier (usually process) contained in the syslog header. + +- name: log.syslog.pid + type: long + description: > + PID contained in the syslog header. + +- name: systemd.cgroup + type: keyword + description: > + The control group path in the systemd hierarchy. + +- name: systemd.invocation_id + type: keyword + description: > + The invocation ID for the runtime cycle of the unit the message was generated in, as available to processes of the unit in $INVOCATION_ID. + +- name: systemd.owner_uid + type: long + description: > + The owner UID of the systemd user unit or systemd session (if any) of the process the journal entry originates from. + +- name: systemd.session + type: keyword + description: > + The systemd session ID (if any). + +- name: systemd.slice + type: keyword + description: > + The systemd slice unit name. + +- name: systemd.transport + type: keyword + description: > + How the entry was received by the journal service. + +- name: systemd.unit + type: keyword + description: > + The systemd unit name. + +- name: systemd.user_slice + type: keyword + description: > + The systemd user slice name. + +- name: systemd.user_unit + type: keyword + description: > + The unit name in the systemd user manager (if any). + +- name: journald.custom + type: flattened + description: >- + Structured fields added to the log message by the caller. diff --git a/packages/journald/data_stream/log/manifest.yml b/packages/journald/data_stream/log/manifest.yml new file mode 100644 index 000000000000..ebe6eeaab407 --- /dev/null +++ b/packages/journald/data_stream/log/manifest.yml @@ -0,0 +1,41 @@ +title: "Journald Log" +type: logs +streams: + - input: journald + title: Journald logs + template_path: journald.yml.hbs + description: Collect journald logs + vars: + - name: include_matches + type: text + title: Include Matches + multi: true + show_user: true + description: > + A list of filter expressions used to select the logs to read (e.g. `_SYSTEMD_UNIT=vault.service`). Defaults to all logs. See [include_matches](https://www.elastic.co/guide/en/beats/filebeat/7.x/filebeat-input-journald.html#filebeat-input-journald-include-matches) for details. + + - name: paths + type: text + title: Journal paths + multi: true + show_user: false + description: > + List of journals to read from. Defaults to the system journal. + + - name: tags + type: text + title: Tags + multi: true + required: true + show_user: false + default: + - journald-log + - name: processors + type: yaml + title: Processors + multi: false + required: false + show_user: false + description: > + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + diff --git a/packages/journald/docs/README.md b/packages/journald/docs/README.md new file mode 100644 index 000000000000..8a54dca8fc8f --- /dev/null +++ b/packages/journald/docs/README.md @@ -0,0 +1,76 @@ +# Journald Input + +The journald input integration reads logs from the `journald` system service. +The journald input reads the log data and the metadata associated with it. + +The journald input is available on Linux systems with `systemd` installed. + +**Exported fields** + +| Field | Description | Type | +|---|---|---| +| @timestamp | Event timestamp. | date | +| container.log.tag | User defined tag of a container. Originates from the Docker journald logging driver. | keyword | +| container.partial | A field that flags log integrity when a message is split. The docker journald logging driver splits long message into multiple events. | boolean | +| data_stream.dataset | Data stream dataset. | constant_keyword | +| data_stream.namespace | Data stream namespace. | constant_keyword | +| data_stream.type | Data stream type. | constant_keyword | +| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | +| host.hostname | The name of the originating host (from journald). | keyword | +| host.id | The machine ID of the originating host (from `machine-id`). | keyword | +| input.type | | keyword | +| journald.audit.login_uid | The login UID of the process the journal entry originates from, as maintained by the kernel audit subsystem. | long | +| journald.audit.session | The session of the process the journal entry originates from, as maintained by the kernel audit subsystem. | keyword | +| journald.code.file | The code location generating this message, if known. Contains the source filename. | keyword | +| journald.code.func | The code location generating this message, if known. Contains the function name. | keyword | +| journald.code.line | The code location generating this message, if known. Contains the line number. | long | +| journald.coredump.unit | Used to annotate messages containing coredumps from system units. | keyword | +| journald.coredump.user_unit | Used to annotate messages containing coredumps from user units. | keyword | +| journald.custom | Structured fields added to the log message by the caller. | flattened | +| journald.gid | The group ID of the process the journal entry originates from formatted as a decimal string. Note that entries obtained via "stdout" or "stderr" of forked processes will contain credentials valid for a parent process. | long | +| journald.host.boot_id | The kernel boot ID for the boot the message was generated in, formatted as a 128-bit hexadecimal string. | keyword | +| journald.kernel.device | The kernel device name. If the entry is associated to a block device, contains the major and minor numbers of the device node, separated by ":" and prefixed by "b". Similarly for character devices, but prefixed by "c". For network devices, this is the interface index prefixed by "n". For all other devices, this is the subsystem name prefixed by "+", followed by ":", followed by the kernel device name. | keyword | +| journald.kernel.device_name | The kernel device name as it shows up in the device tree below `/sys/`. | keyword | +| journald.kernel.device_node_path | The device node path of this device in `/dev/`. | keyword | +| journald.kernel.device_symlinks | Additional symlink names pointing to the device node in `/dev/`. This field is frequently set more than once per entry. | keyword | +| journald.kernel.subsystem | The kernel subsystem name. | keyword | +| journald.object.audit.login_uid | | long | +| journald.object.audit.session | | long | +| journald.object.gid | | long | +| journald.object.pid | Privileged programs (currently UID 0) may attach OBJECT_PID= to a message. This will instruct systemd-journald to attach additional `journald.object.\*` on behalf of the caller. These additional fields added automatically by systemd-journald. These additional `journald.object.\*` fields are the same as the equivalent `journald.\*` field except that the process identified by PID is described, instead of the process which logged the message. | long | +| journald.object.process.command_line | | keyword | +| journald.object.process.executable | | keyword | +| journald.object.process.name | | keyword | +| journald.object.systemd.owner_uid | | long | +| journald.object.systemd.session | | keyword | +| journald.object.systemd.unit | | keyword | +| journald.object.systemd.user_unit | | keyword | +| journald.object.uid | | long | +| journald.pid | The process ID of the process the journal entry originates from formatted as a decimal string. Note that entries obtained via "stdout" or "stderr" of forked processes will contain credentials valid for a parent process. | long | +| journald.process.capabilities | The effective capabilities(7) of the process the journal entry originates from. | keyword | +| journald.process.command_line | The command line of the process the journal entry originates from. | keyword | +| journald.process.executable | The executable path of the process the journal entry originates from. | keyword | +| journald.process.name | The name of the process the journal entry originates from. | keyword | +| journald.uid | The user ID of the process the journal entry originates from formatted as a decimal string. Note that entries obtained via "stdout" or "stderr" of forked processes will contain credentials valid for a parent process. | long | +| log.syslog.facility.code | The Syslog numeric facility of the log event, if available. According to RFCs 5424 and 3164, this value should be an integer between 0 and 23. | long | +| log.syslog.identifier | Identifier (usually process) contained in the syslog header. | keyword | +| log.syslog.pid | PID contained in the syslog header. | long | +| log.syslog.priority | Syslog numeric priority of the event, if available. According to RFCs 5424 and 3164, the priority is 8 \* facility + severity. This number is therefore expected to contain a value between 0 and 191. | long | +| message | For log events the message field contains the log message, optimized for viewing in a log viewer. For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event. If multiple messages exist, they can be combined into one message. | text | +| process.args | Array of process arguments, starting with the absolute path to the executable. May be filtered to protect sensitive information. | keyword | +| process.args_count | Length of the process.args array. This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity. | long | +| process.command_line | Full command line that started the process, including the absolute path to the executable, and all arguments. Some arguments may be filtered to protect sensitive information. | keyword | +| process.pid | Process id. | long | +| systemd.cgroup | The control group path in the systemd hierarchy. | keyword | +| systemd.invocation_id | The invocation ID for the runtime cycle of the unit the message was generated in, as available to processes of the unit in $INVOCATION_ID. | keyword | +| systemd.owner_uid | The owner UID of the systemd user unit or systemd session (if any) of the process the journal entry originates from. | long | +| systemd.session | The systemd session ID (if any). | keyword | +| systemd.slice | The systemd slice unit name. | keyword | +| systemd.transport | How the entry was received by the journal service. | keyword | +| systemd.unit | The systemd unit name. | keyword | +| systemd.user_slice | The systemd user slice name. | keyword | +| systemd.user_unit | The unit name in the systemd user manager (if any). | keyword | +| tags | List of keywords used to tag each event. | keyword | +| user.group.id | Unique identifier for the group on the system/platform. | keyword | +| user.id | Unique identifier of the user. | keyword | + diff --git a/packages/journald/img/systemd-logo.svg b/packages/journald/img/systemd-logo.svg new file mode 100644 index 000000000000..24278b6978bf --- /dev/null +++ b/packages/journald/img/systemd-logo.svg @@ -0,0 +1,5 @@ + + + + + \ No newline at end of file diff --git a/packages/journald/manifest.yml b/packages/journald/manifest.yml new file mode 100644 index 000000000000..66a1919d1629 --- /dev/null +++ b/packages/journald/manifest.yml @@ -0,0 +1,27 @@ +format_version: 1.0.0 +name: journald +title: "Custom Journald logs" +version: 0.0.1 +license: basic +description: "This Elastic integration collects custom jourald logs" +type: integration +categories: + - custom +release: experimental +conditions: + kibana.version: "^7.16.0" +icons: + - src: /img/systemd-logo.svg + title: systemd logo + size: 32x32 + type: image/svg+xml +policy_templates: + - name: logs + title: Journald + description: Collect sample logs + inputs: + - type: journald + title: Journald logs + description: Collect journald logs +owner: + github: elastic/integrations