logstash cleanup - https://github.com/Security-Onion-Solutions/securityonion-saltstack/issues/326

pillar/logstash/helix.sls

@@ -1,4 +1,42 @@
 logstash:
   pipelines:
     helix:
-      config: "/usr/share/logstash/pipelines/helix/*.conf"
+      config:
+        - 0010_input_hhbeats.conf
+        - 1033_preprocess_snort.conf
+        - 1100_preprocess_bro_conn.conf
+        - 1101_preprocess_bro_dhcp.conf
+        - 1102_preprocess_bro_dns.conf
+        - 1103_preprocess_bro_dpd.conf
+        - 1104_preprocess_bro_files.conf
+        - 1105_preprocess_bro_ftp.conf
+        - 1106_preprocess_bro_http.conf
+        - 1107_preprocess_bro_irc.conf
+        - 1108_preprocess_bro_kerberos.conf
+        - 1109_preprocess_bro_notice.conf
+        - 1110_preprocess_bro_rdp.conf
+        - 1111_preprocess_bro_signatures.conf
+        - 1112_preprocess_bro_smtp.conf
+        - 1113_preprocess_bro_snmp.conf
+        - 1114_preprocess_bro_software.conf
+        - 1115_preprocess_bro_ssh.conf
+        - 1116_preprocess_bro_ssl.conf
+        - 1117_preprocess_bro_syslog.conf
+        - 1118_preprocess_bro_tunnel.conf
+        - 1119_preprocess_bro_weird.conf
+        - 1121_preprocess_bro_mysql.conf
+        - 1122_preprocess_bro_socks.conf
+        - 1123_preprocess_bro_x509.conf
+        - 1124_preprocess_bro_intel.conf
+        - 1125_preprocess_bro_modbus.conf
+        - 1126_preprocess_bro_sip.conf
+        - 1127_preprocess_bro_radius.conf
+        - 1128_preprocess_bro_pe.conf
+        - 1129_preprocess_bro_rfb.conf
+        - 1130_preprocess_bro_dnp3.conf
+        - 1131_preprocess_bro_smb_files.conf
+        - 1132_preprocess_bro_smb_mapping.conf
+        - 1133_preprocess_bro_ntlm.conf
+        - 1134_preprocess_bro_dce_rpc.conf
+        - 8001_postprocess_common_ip_augmentation.conf
+        - 9997_output_helix.conf.jinja

pillar/logstash/master.sls

@@ -1,4 +1,6 @@
 logstash:
   pipelines:
     master:
-      config: "/usr/share/logstash/pipelines/master/*.conf"
+      config:
+        - 0010_input_hhbeats.conf
+        - 9999_output_redis.conf.jinja

pillar/logstash/search.sls

@@ -1,4 +1,55 @@
 logstash:
   pipelines:
     search:
-      config: "/usr/share/logstash/pipelines/search/*.conf"
+      config:
+        - 1000_preprocess_log_elapsed.conf
+        - 1001_preprocess_syslogng.conf
+        - 1002_preprocess_json.conf
+        - 1004_preprocess_syslog_types.conf
+        - 1026_preprocess_dhcp.conf
+        - 1029_preprocess_esxi.conf
+        - 1030_preprocess_greensql.conf
+        - 1031_preprocess_iis.conf
+        - 1032_preprocess_mcafee.conf
+        - 1033_preprocess_snort.conf
+        - 1034_preprocess_syslog.conf
+        - 2000_network_flow.conf
+        - 6002_syslog.conf
+        - 6101_switch_brocade.conf
+        - 6200_firewall_fortinet.conf
+        - 6201_firewall_pfsense.conf
+        - 6300_windows.conf
+        - 6301_dns_windows.conf
+        - 6400_suricata.conf
+        - 6500_ossec.conf
+        - 6501_ossec_sysmon.conf
+        - 6502_ossec_autoruns.conf
+        - 6600_winlogbeat_sysmon.conf
+        - 6700_winlogbeat.conf
+        - 7100_osquery_wel.conf
+        - 7200_strelka.conf
+        - 8001_postprocess_common_ip_augmentation.conf
+        - 8007_postprocess_http.conf
+        - 8200_postprocess_tagging.conf
+        - 8998_postprocess_log_elapsed.conf
+        - 8999_postprocess_rename_type.conf
+        - 0900_input_redis.conf.jinja
+        - 9000_output_bro.conf.jinja
+        - 9001_output_switch.conf.jinja
+        - 9002_output_import.conf.jinja
+        - 9004_output_flow.conf.jinja
+        - 9026_output_dhcp.conf.jinja
+        - 9029_output_esxi.conf.jinja
+        - 9030_output_greensql.conf.jinja
+        - 9031_output_iis.conf.jinja
+        - 9032_output_mcafee.conf.jinja
+        - 9033_output_snort.conf.jinja
+        - 9034_output_syslog.conf.jinja
+        - 9100_output_osquery.conf.jinja
+        - 9200_output_firewall.conf.jinja
+        - 9300_output_windows.conf.jinja
+        - 9301_output_dns_windows.conf.jinja
+        - 9400_output_suricata.conf.jinja
+        - 9500_output_beats.conf.jinja
+        - 9600_output_ossec.conf.jinja
+        - 9700_output_strelka.conf.jinja