CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 09:12:45 +01:00
Code Issues Packages Projects Releases Wiki Activity

fix issue with salt not removing pipeline configs or templates if removed from pillar

Browse Source
This commit is contained in:
m0duspwnens
2020-03-04 10:12:28 -05:00
parent f40b23e4b2
commit 28c4bb4b22
1 changed files with 38 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

53
salt/logstash/init.sls
View File

@@ -85,12 +85,6 @@ lspipelinedir:
- group: 939 - group: 939
{% for PL in PIPELINES %} {% for PL in PIPELINES %}
ls_pipeline_{{PL}}:
file.directory:
- name: /opt/so/conf/logstash/pipelines/{{PL}}
- user: 931
- group: 939
{% for CONFIGFILE in PIPELINES[PL].config %} {% for CONFIGFILE in PIPELINES[PL].config %}
ls_pipeline_{{PL}}_{{CONFIGFILE.split('.')[0] | replace("/","_") }}: ls_pipeline_{{PL}}_{{CONFIGFILE.split('.')[0] | replace("/","_") }}:
file.managed: file.managed:
@@ -103,10 +97,23 @@ ls_pipeline_{{PL}}_{{CONFIGFILE.split('.')[0] | replace("/","_") }}:
{% endif %} {% endif %}
- user: 931 - user: 931
- group: 939 - group: 939
{% endfor %} - makedirs: True
{% endfor %} {% endfor %}
#sync templates to /opt/so/conf/logstash/etc/ here ls_pipeline_{{PL}}:
file.directory:
- name: /opt/so/conf/logstash/pipelines/{{PL}}
- user: 931
- group: 939
- require:
{% for CONFIGFILE in PIPELINES[PL].config %}
- file: ls_pipeline_{{PL}}_{{CONFIGFILE.split('.')[0] | replace("/","_") }}
{% endfor %}
- clean: True
{% endfor %}
#sync templates to /opt/so/conf/logstash/etc
{% for TEMPLATE in TEMPLATES %} {% for TEMPLATE in TEMPLATES %}
ls_template_{{TEMPLATE.split('.')[0] | replace("/","_") }}: ls_template_{{TEMPLATE.split('.')[0] | replace("/","_") }}:
file.managed: file.managed:
@@ -129,7 +136,7 @@ lspipelinesyml:
- defaults: - defaults:
pipelines: {{ PIPELINES }} pipelines: {{ PIPELINES }}
# Copy down all the configs including custom - TODO add watch restart # Copy down all the configs
lsetcsync: lsetcsync:
file.recurse: file.recurse:
- name: /opt/so/conf/logstash/etc - name: /opt/so/conf/logstash/etc
@@ -137,6 +144,11 @@ lsetcsync:
- user: 931 - user: 931
- group: 939 - group: 939
- template: jinja - template: jinja
- clean: True
- require:
{% for TEMPLATE in TEMPLATES %}
- file: ls_template_{{TEMPLATE.split('.')[0] | replace("/","_") }}
{% endfor %}
- exclude_pat: pipelines* - exclude_pat: pipelines*
# Create the import directory # Create the import directory
@@ -176,12 +188,15 @@ so-logstash:
- {{ BINDING }} - {{ BINDING }}
{% endfor %} {% endfor %}
- binds: - binds:
{% for TEMPLATE in TEMPLATES %}
{% if 'jinja' in TEMPLATE.split('.')[-1] %}
- /opt/so/conf/logstash/etc/{{TEMPLATE.split('/')[1] | replace(".jinja", "")}}:/{{TEMPLATE.split('/')[1] | replace(".jinja", "")}}:ro
{% else %}
- /opt/so/conf/logstash/etc/{{TEMPLATE.split('/')[1]}}:/{{TEMPLATE.split('/')[1]}}:ro
{% endif %}
{% endfor %}
- /opt/so/conf/logstash/etc/log4j2.properties:/usr/share/logstash/config/log4j2.properties:ro - /opt/so/conf/logstash/etc/log4j2.properties:/usr/share/logstash/config/log4j2.properties:ro
- /opt/so/conf/logstash/etc/logstash.yml:/usr/share/logstash/config/logstash.yml:ro - /opt/so/conf/logstash/etc/logstash.yml:/usr/share/logstash/config/logstash.yml:ro
- /opt/so/conf/logstash/etc/logstash-template.json:/logstash-template.json:ro
- /opt/so/conf/logstash/etc/logstash-ossec-template.json:/logstash-ossec-template.json:ro
- /opt/so/conf/logstash/etc/logstash-strelka-template.json:/logstash-strelka-template.json:ro
- /opt/so/conf/logstash/etc/beats-template.json:/beats-template.json:ro
- /opt/so/conf/logstash/etc/pipelines.yml:/usr/share/logstash/config/pipelines.yml - /opt/so/conf/logstash/etc/pipelines.yml:/usr/share/logstash/config/pipelines.yml
- /opt/so/conf/logstash/pipelines:/usr/share/logstash/pipelines:ro - /opt/so/conf/logstash/pipelines:/usr/share/logstash/pipelines:ro
- /opt/so/rules:/etc/nsm/rules:ro - /opt/so/rules:/etc/nsm/rules:ro
@@ -201,6 +216,14 @@ so-logstash:
- /opt/so/log/strelka:/strelka:ro - /opt/so/log/strelka:/strelka:ro
{%- endif %} {%- endif %}
- watch: - watch:
- file: /opt/so/conf/logstash/etc - file: lsetcsync
- file: /opt/so/conf/logstash/pipelines {% for PL in PIPELINES %}
- file: ls_pipeline_{{PL}}
{% for CONFIGFILE in PIPELINES[PL].config %}
- file: ls_pipeline_{{PL}}_{{CONFIGFILE.split('.')[0] | replace("/","_") }}
{% endfor %}
{% endfor %}
{% for TEMPLATE in TEMPLATES %}
- file: ls_template_{{TEMPLATE.split('.')[0] | replace("/","_") }}
{% endfor %}
# - file: /opt/so/conf/logstash/rulesets # - file: /opt/so/conf/logstash/rulesets