CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2026-05-02 17:37:58 +02:00
Code Issues Packages Projects Releases Wiki Activity

logstash jinja for ui

Browse Source
This commit is contained in:
m0duspwnens
2023-05-04 13:07:07 -04:00
parent 71b6311edc
commit 082704ce1f
6 changed files with 13 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
salt/logstash/defaults.yaml
+2 -2
View File
@@ -30,7 +30,7 @@ logstash:
- so/0011_input_endgame.conf - so/0011_input_endgame.conf
- so/0012_input_elastic_agent.conf - so/0012_input_elastic_agent.conf
- so/9999_output_redis.conf.jinja - so/9999_output_redis.conf.jinja
searchnode: search:
- so/0900_input_redis.conf.jinja - so/0900_input_redis.conf.jinja
- so/9805_output_elastic_agent.conf.jinja - so/9805_output_elastic_agent.conf.jinja
- so/9900_output_endgame.conf.jinja - so/9900_output_endgame.conf.jinja
@@ -59,5 +59,5 @@ logstash:
pipeline_x_workers: 1 pipeline_x_workers: 1
pipeline_x_batch_x_size: 125 pipeline_x_batch_x_size: 125
pipeline_x_ecs_compatibility: disabled pipeline_x_ecs_compatibility: disabled
dmz_nodes: {} dmz_nodes: []
salt/logstash/etc/logstash.yml
+1 -5
View File
@@ -1,5 +1 @@
http.host: 0.0.0.0 {{ LOGSTASH_MERGED.config | yaml(False) | replace("_x_", ".") }}
path.logs: /var/log/logstash
pipeline.workers: {{ pipeline_workers }}
pipeline.batch.size: {{ pipeline_batch }}
pipeline.ecs_compatibility: {{ pipeline_ecs_compatibility }}
salt/logstash/etc/pipelines.yml.jinja
+3 -3
View File
@@ -1,4 +1,4 @@
{%- for ap in assigned_pipelines %} {%- for assigned_pipeline in ASSIGNED_PIPELINES %}
- pipeline.id: {{ ap }} - pipeline.id: {{ assigned_pipeline }}
path.config: "/usr/share/logstash/pipelines/{{ ap }}/" path.config: "/usr/share/logstash/pipelines/{{ assigned_pipeline }}/"
{% endfor -%} {% endfor -%}
salt/logstash/init.sls
+7 -5
View File
@@ -68,6 +68,8 @@ ls_pipeline_{{assigned_pipeline}}_{{CONFIGFILE.split('.')[0] | replace("/","_")
GLOBALS: {{ GLOBALS }} GLOBALS: {{ GLOBALS }}
ES_USER: "{{ salt['pillar.get']('elasticsearch:auth:users:so_elastic_user:user', '') }}" ES_USER: "{{ salt['pillar.get']('elasticsearch:auth:users:so_elastic_user:user', '') }}"
ES_PASS: "{{ salt['pillar.get']('elasticsearch:auth:users:so_elastic_user:pass', '') }}" ES_PASS: "{{ salt['pillar.get']('elasticsearch:auth:users:so_elastic_user:pass', '') }}"
THREADS: {{ LOGSTASH_MERGED.config.pipeline_x_workers }}
BATCH: {{ LOGSTASH_MERGED.config.pipeline_x_batch_x_size }}
{% else %} {% else %}
- name: /opt/so/conf/logstash/pipelines/{{assigned_pipeline}}/{{CONFIGFILE.split('/')[1]}} - name: /opt/so/conf/logstash/pipelines/{{assigned_pipeline}}/{{CONFIGFILE.split('/')[1]}}
{% endif %} {% endif %}
@@ -88,19 +90,17 @@ ls_pipeline_{{assigned_pipeline}}:
- file: ls_pipeline_{{assigned_pipeline}}_{{CONFIGFILE.split('.')[0] | replace("/","_") }} - file: ls_pipeline_{{assigned_pipeline}}_{{CONFIGFILE.split('.')[0] | replace("/","_") }}
{% endfor %} {% endfor %}
- clean: True - clean: True
{% endfor %}
{% endfor %} {% endfor %}
# Copy down all the configs
lspipelinesyml: lspipelinesyml:
file.managed: file.managed:
- name: /opt/so/conf/logstash/etc/pipelines.yml - name: /opt/so/conf/logstash/etc/pipelines.yml
- source: salt://logstash/etc/pipelines.yml.jinja - source: salt://logstash/etc/pipelines.yml.jinja
- template: jinja - template: jinja
- defaults: - defaults:
assigned_pipelines: {{ ASSIGNED_PIPELINES }} ASSIGNED_PIPELINES: {{ ASSIGNED_PIPELINES }}
# Copy down all the configs
lsetcsync: lsetcsync:
file.recurse: file.recurse:
- name: /opt/so/conf/logstash/etc - name: /opt/so/conf/logstash/etc
@@ -110,6 +110,8 @@ lsetcsync:
- template: jinja - template: jinja
- clean: True - clean: True
- exclude_pat: pipelines* - exclude_pat: pipelines*
- defaults:
LOGSTASH_MERGED: {{ LOGSTASH_MERGED }}
# Create the import directory # Create the import directory
importdir: importdir:
@@ -188,7 +190,7 @@ so-logstash:
- file: lsetcsync - file: lsetcsync
{% for assigned_pipeline in LOGSTASH_MERGED.assigned_pipelines.roles[GLOBALS.role.split('-')[1]] %} {% for assigned_pipeline in LOGSTASH_MERGED.assigned_pipelines.roles[GLOBALS.role.split('-')[1]] %}
- file: ls_pipeline_{{assigned_pipeline}} - file: ls_pipeline_{{assigned_pipeline}}
{% for CONFIGFILE in LOGSTASH_MERGED.defined_pipelines[ap] %} {% for CONFIGFILE in LOGSTASH_MERGED.defined_pipelines[assigned_pipeline] %}
- file: ls_pipeline_{{assigned_pipeline}}_{{CONFIGFILE.split('.')[0] | replace("/","_") }} - file: ls_pipeline_{{assigned_pipeline}}_{{CONFIGFILE.split('.')[0] | replace("/","_") }}
{% endfor %} {% endfor %}
{% endfor %} {% endfor %}
salt/logstash/pipelines/config/so/0900_input_redis.conf.jinja
-2
View File
@@ -1,5 +1,3 @@
{%- set THREADS = salt['pillar.get']('logstash:settings:pipeline_x_workers') %}
{%- set BATCH = salt['pillar.get']('logstash:settings:pipeline_x_batch_x_size', 125) %}
{%- from 'logstash/map.jinja' import REDIS_NODES with context %} {%- from 'logstash/map.jinja' import REDIS_NODES with context %}
{%- set REDIS_PASS = salt['pillar.get']('redis:config:requirepass') %} {%- set REDIS_PASS = salt['pillar.get']('redis:config:requirepass') %}
salt/logstash/pipelines/config/so/9999_output_redis.conf.jinja
-1
View File
@@ -3,7 +3,6 @@
{%- else %} {%- else %}
{%- set HOST = GLOBALS.manager %} {%- set HOST = GLOBALS.manager %}
{%- endif %} {%- endif %}
{%- set BATCH = salt['pillar.get']('logstash:settings:pipeline_x_batch_x_size') %}
{%- set REDIS_PASS = salt['pillar.get']('redis:config:requirepass') %} {%- set REDIS_PASS = salt['pillar.get']('redis:config:requirepass') %}
output { output {