Merge remote-tracking branch 'remotes/origin/dev' into issue/5955

2025-12-06 09:12:45 +01:00 · 2021-10-25 16:29:41 -04:00
parent 7e8d74e770 c469d12a49
commit 0c679b62b2
13 changed files with 550 additions and 172 deletions
--- a/salt/logstash/pipelines/config/so/0011_input_endgame.conf
+++ b/salt/logstash/pipelines/config/so/0011_input_endgame.conf
@@ -3,6 +3,8 @@ input {
    id => "endgame_data"
    port => 3765
    codec => es_bulk
+    request_headers_target_field => client_headers
+    remote_host_target_field => client_host
    ssl => true
    ssl_certificate_authorities => ["/usr/share/filebeat/ca.crt"]
    ssl_certificate => "/usr/share/logstash/filebeat.crt"
--- a/salt/logstash/pipelines/config/so/9900_output_endgame.conf.jinja
+++ b/salt/logstash/pipelines/config/so/9900_output_endgame.conf.jinja
@@ -8,7 +8,7 @@
 filter {
  if [event][module] =~ "endgame" {
    mutate {
-      remove_field => ["headers", "host"]
+      remove_field => ["client_headers", "client_host"]
    }
  }
 }