Merge pull request #390 from Security-Onion-Solutions/ls_config_cleanup

Ls config cleanup

pillar/logstash/eval.sls

@@ -4,24 +4,8 @@ logstash:
       config:
         - so/0800_input_eval.conf
         - so/1000_preprocess_log_elapsed.conf
-        - so/1001_preprocess_syslogng.conf
         - so/1002_preprocess_json.conf
-        - so/1004_preprocess_syslog_types.conf
-        - so/1026_preprocess_dhcp.conf
-        - so/1029_preprocess_esxi.conf
-        - so/1030_preprocess_greensql.conf
-        - so/1031_preprocess_iis.conf
-        - so/1032_preprocess_mcafee.conf
         - so/1033_preprocess_snort.conf
-        - so/1034_preprocess_syslog.conf
-        - so/2000_network_flow.conf
-        - so/6002_syslog.conf
-        - so/6101_switch_brocade.conf
-        - so/6200_firewall_fortinet.conf
-        - so/6201_firewall_pfsense.conf
-        - so/6300_windows.conf
-        - so/6301_dns_windows.conf
-        - so/6400_suricata.conf
         - so/6500_ossec.conf
         - so/6501_ossec_sysmon.conf
         - so/6502_ossec_autoruns.conf
@@ -29,26 +13,13 @@ logstash:
         - so/6700_winlogbeat.conf
         - so/7100_osquery_wel.conf
         - so/7200_strelka.conf
-        - so/8001_postprocess_common_ip_augmentation.conf
-        - so/8007_postprocess_http.conf
-        - so/8200_postprocess_tagging.conf
         - so/8998_postprocess_log_elapsed.conf
         - so/8999_postprocess_rename_type.conf
         - so/9000_output_bro.conf.jinja
-        - so/9001_output_switch.conf.jinja
         - so/9002_output_import.conf.jinja
-        - so/9004_output_flow.conf.jinja
-        - so/9026_output_dhcp.conf.jinja
-        - so/9029_output_esxi.conf.jinja
-        - so/9030_output_greensql.conf.jinja
-        - so/9031_output_iis.conf.jinja
-        - so/9032_output_mcafee.conf.jinja
         - so/9033_output_snort.conf.jinja
-        - so/9034_output_syslog.conf.jinja
         - so/9100_output_osquery.conf.jinja
         - so/9200_output_firewall.conf.jinja
-        - so/9300_output_windows.conf.jinja
-        - so/9301_output_dns_windows.conf.jinja
         - so/9400_output_suricata.conf.jinja
         - so/9500_output_beats.conf.jinja
         - so/9600_output_ossec.conf.jinja

salt/logstash/pipelines/templates/so/logstash-template.json

@@ -738,6 +738,10 @@
             }
           }
         },
+	"destination":{
+          "type":"object",
+          "dynamic": true
+        },
         "destination_city":{
           "type":"text",
           "fields":{
@@ -2946,6 +2950,10 @@
             }
           }
         },
+	"source":{
+          "type":"object",
+          "dynamic": true
+        },
         "source_geo.city_name":{
           "type":"text",
           "fields":{