From 01db0e6d61dee034c865f84449dcdd7a186667c6 Mon Sep 17 00:00:00 2001
From: Mike Reeves <luke@geekempire.com>
Date: Thu, 1 Nov 2018 18:49:04 -0400
Subject: [PATCH] Logstash Module - Add path to logs

---
 salt/logstash/init.sls | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/salt/logstash/init.sls b/salt/logstash/init.sls
index 84d72125e..c597cf5fd 100644
--- a/salt/logstash/init.sls
+++ b/salt/logstash/init.sls
@@ -141,3 +141,7 @@ so-logstash:
       - /etc/pki/filebeat.crt:/usr/share/logstash/filebeat.crt:ro
       - /etc/pki/filebeat.p8:/usr/share/logstash/filebeat.key:ro
       - /etc/pki/ca.crt:/usr/share/filebeat/ca.crt:ro
+      {%- if grains['role'] == 'so-eval' %}
+      - /nsm/bro/logs:/nsm/bro/logs:ro
+      - /opt/so/log/suricata:/suricata:ro
+      {%- endif %}