From 1970d95d5f7f437da75928a7119e628a51d6a9ef Mon Sep 17 00:00:00 2001 From: Wes Lambert Date: Mon, 5 Oct 2020 13:30:04 +0000 Subject: [PATCH] Make Filebeat registry persistent to avoid re-reading old data --- salt/filebeat/init.sls | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/salt/filebeat/init.sls b/salt/filebeat/init.sls index 8937d8e13..28c04d01a 100644 --- a/salt/filebeat/init.sls +++ b/salt/filebeat/init.sls @@ -44,6 +44,12 @@ filebeatpkidir: - user: 939 - group: 939 - makedirs: True +fileregistrydir: + file.directory: + - name: /opt/so/conf/filebeat/registry + - user: 939 + - group: 939 + - makedirs: True # This needs to be owned by root filebeatconfsync: file.managed: @@ -69,6 +75,7 @@ so-filebeat: - /nsm/wazuh/logs/archives:/wazuh/archives:ro - /opt/so/conf/filebeat/etc/pki/filebeat.crt:/usr/share/filebeat/filebeat.crt:ro - /opt/so/conf/filebeat/etc/pki/filebeat.key:/usr/share/filebeat/filebeat.key:ro + - /opt/so/conf/filebeat/registry:/usr/share/filebeat/data/registry:rw - /etc/ssl/certs/intca.crt:/usr/share/filebeat/intraca.crt:ro - port_bindings: - 0.0.0.0:514:514/udp @@ -81,4 +88,4 @@ filebeat_state_not_allowed: test.fail_without_changes: - name: filebeat_state_not_allowed -{% endif %} \ No newline at end of file +{% endif %}