CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 09:12:45 +01:00
Code Issues Packages Projects Releases Wiki Activity

Logstash - Wazuh parsing updates

Browse Source
This commit is contained in:
Wes Lambert
2018-12-14 18:00:19 +00:00
parent 46372d1384
commit 172c9e0593
1 changed files with 2 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
salt/logstash/files/dynamic/0006_input_beats.conf
View File

@@ -15,6 +15,7 @@ filter {
remove_tag => ["beat"] remove_tag => ["beat"]
add_field => { "sensor_name" => "%{[beat][name]}" } add_field => { "sensor_name" => "%{[beat][name]}" }
add_field => { "syslog-host_from" => "%{[beat][name]}" } add_field => { "syslog-host_from" => "%{[beat][name]}" }
remove_field => [ "beat", "prospector", "input", "offset" ]
} }
} }
if [type] =~ "ossec" { if [type] =~ "ossec" {
@@ -22,6 +23,7 @@ filter {
rename => { "host" => "beat_host" } rename => { "host" => "beat_host" }
remove_tag => ["beat"] remove_tag => ["beat"]
add_field => { "syslog-host_from" => "%{[beat][name]}" } add_field => { "syslog-host_from" => "%{[beat][name]}" }
remove_field => [ "beat", "prospector", "input", "offset" ]
} }
} }
} }