mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2025-12-06 17:22:49 +01:00
Logstash Module - Saltify some inputs
This commit is contained in:
@@ -7,6 +7,7 @@
|
||||
# /usr/share/logstash/pipeline.custom/1234_input_custom.conf
|
||||
##
|
||||
# All of the defaults are loaded.
|
||||
/usr/share/logstash/pipeline.dynamic/0900_input_redis.conf
|
||||
/usr/share/logstash/pipeline.so/1000_preprocess_log_elapsed.conf
|
||||
/usr/share/logstash/pipeline.so/1001_preprocess_syslogng.conf
|
||||
/usr/share/logstash/pipeline.so/1002_preprocess_json.conf
|
||||
|
||||
@@ -1,8 +1,13 @@
|
||||
{%- set nodetype = salt['pillar_get']('node:node_type', 'storage') %}
|
||||
output {
|
||||
redis {
|
||||
host => 'so-redis'
|
||||
data_type => 'list'
|
||||
key => 'logstash:redis'
|
||||
{%- if nodetype == 'parser' %}
|
||||
key => 'logstash:parsed'
|
||||
{%- else %}
|
||||
key => 'logstash:unparsed'
|
||||
{%- endif %)
|
||||
congestion_interval => 1
|
||||
congestion_threshold => 50000000
|
||||
# batch_events => 500
|
||||
|
||||
@@ -23,7 +23,7 @@ base:
|
||||
- logstash
|
||||
|
||||
'G@role:so-node':
|
||||
{% if nodetype == 'parsing' %}
|
||||
{%- if nodetype == 'parsing' %}
|
||||
- common
|
||||
- logstash
|
||||
{% elsif nodetype == 'hot' %}
|
||||
|
||||
Reference in New Issue
Block a user