Fix logscan pipeline on eval

* Rename logscan pipeline to logscan.alert
* Add module to indices array in filebeat.yml

salt/filebeat/etc/filebeat.yml

@@ -307,6 +307,9 @@ output.elasticsearch:
     - index: "so-strelka"
       when.contains:
         module: "strelka"
+    - index: "so-logscan"
+      when.contains:
+        module: "logscan"
   
 setup.template.enabled: false
   {%- else %}

salt/logstash/pipelines/config/so/9800_output_logscan.conf.jinja

@@ -10,7 +10,7 @@ output {
   if [module] =~ "logscan" {
     elasticsearch {
       id => "logscan_pipeline"
-      pipeline => "logscan"
+      pipeline => "logscan.alert"
       hosts => "{{ ES }}"
     {% if salt['pillar.get']('elasticsearch:auth:enabled') is sameas true %}
       user => "{{ ES_USER }}"