CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 09:12:45 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #7422 from Security-Onion-Solutions/fix/syslog_dot_keyword

Browse Source 
.keyword additions and increase max_clause_count
This commit is contained in:
weslambert
2022-03-04 15:32:29 -05:00
committed by GitHub
parent 93c2f82345 254cf53c2f
commit 3148fa0e06
2 changed files with 81 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
salt/elasticsearch/defaults.yaml
View File

@@ -55,7 +55,7 @@ elasticsearch:
indices:
query:
bool:
max_clause_count: 3000
max_clause_count: 3500
id_field_data:
enabled: false
logger:
@@ -845,6 +845,8 @@ elasticsearch:
- source-mappings
- dtc-source-mappings
- pb-override-source-mappings
- syslog-mappings
- dtc-syslog-mappings
- threat-mappings
- tls-mappings
- tracing-mappings
@@ -1342,6 +1344,8 @@ elasticsearch:
- source-mappings
- dtc-source-mappings
- pb-override-source-mappings
- syslog-mappings
- dtc-syslog-mappings
- threat-mappings
- tls-mappings
- tracing-mappings
@@ -3900,6 +3904,7 @@ elasticsearch:
- dtc-source-mappings
- pb-override-source-mappings
- syslog-mappings
- dtc-syslog-mappings
- threat-mappings
- tls-mappings
- tracing-mappings
@@ -4064,6 +4069,8 @@ elasticsearch:
- source-mappings
- dtc-source-mappings
- pb-override-source-mappings
- syslog-mappings
- dtc-syslog-mappings
- threat-mappings
- tls-mappings
- tracing-mappings

73
salt/elasticsearch/templates/component/so/dtc-syslog-mappings.json Normal file
View File

@@ -0,0 +1,73 @@
{
"_meta": {
"documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-syslog.html",
"ecs_version": "1.12.2"
},
"template": {
"settings": {
"analysis": {
"analyzer": {
"es_security_analyzer": {
"type": "custom",
"char_filter": [
"whitespace_no_way"
],
"filter": [
"lowercase",
"trim"
],
"tokenizer": "keyword"
}
},
"char_filter": {
"whitespace_no_way": {
"type": "pattern_replace",
"pattern": "(\\s)+",
"replacement": "$1"
}
},
"filter": {
"path_hierarchy_pattern_filter": {
"type": "pattern_capture",
"preserve_original": true,
"patterns": [
"((?:[^\\\\]*\\\\)*)(.*)",
"((?:[^/]*/)*)(.*)"
]
}
},
"tokenizer": {
"path_tokenizer": {
"type": "path_hierarchy",
"delimiter": "\\"
}
}
}
},
"mappings": {
"properties": {
"syslog": {
"properties": {
"facility": {
"type": "long",
"fields": {
"keyword": {
"type": "keyword"
}
}
},
"priority": {
"type": "long",
"fields": {
"keyword": {
"type": "keyword"
}
}
}
}
}
}
}
}
}