merge with dev and resolv conflicts

salt/elastalert/files/elastalert_config.yaml

@@ -86,3 +86,25 @@ alert_time_limit:
 index_settings:
   shards: 1
   replicas: 0
+
+logging:
+  version: 1
+  incremental: false
+  disable_existing_loggers: false
+  formatters:
+    logline:
+      format: '%(asctime)s %(levelname)+8s %(name)+20s %(message)s'
+
+  handlers:
+    file:
+      class : logging.FileHandler
+      formatter: logline
+      level: INFO
+      filename: /var/log/elastalert/elastalert.log
+
+  loggers:
+    '':
+      level: INFO
+      handlers:
+        - file
+      propagate: false

salt/elastalert/files/modules/so/playbook-es.py

@@ -1,6 +1,6 @@
 # -*- coding: utf-8 -*-
 
-from datetime import date   
+from time import gmtime, strftime
 import requests,json
 from elastalert.alerts import Alerter
 
@@ -13,11 +13,12 @@ class PlaybookESAlerter(Alerter):
 
     def alert(self, matches):
        for match in matches:
+            today = strftime("%Y.%m.%d", gmtime())
+            timestamp = strftime("%Y-%m-%d"'T'"%H:%M:%S", gmtime())
             headers = {"Content-Type": "application/json"}
-            payload = {"play_title": self.rule['play_title'],"play_url": self.rule['play_url'],"sigma_level": self.rule['sigma_level'],"data": match}
-            today = str(date.today())
-            url = f"http://{self.rule['elasticsearch_host']}/playbook-alerts-{today}/_doc/"
+            payload = {"rule.name": self.rule['play_title'],"event.severity": self.rule['event.severity'],"kibana_pivot": self.rule['kibana_pivot'],"soc_pivot": self.rule['soc_pivot'],"event.module": self.rule['event.module'],"event.dataset": self.rule['event.dataset'],"play_url": self.rule['play_url'],"sigma_level": self.rule['sigma_level'],"rule.category": self.rule['rule.category'],"data": match, "@timestamp": timestamp}
+            url = f"http://{self.rule['elasticsearch_host']}/so-playbook-alerts-{today}/_doc/"
             requests.post(url, data=json.dumps(payload), headers=headers, verify=False)
                             
     def get_info(self):
-        return {'type': 'PlaybookESAlerter'} 
+        return {'type': 'PlaybookESAlerter'}