mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2026-04-25 22:17:49 +02:00
Add additional config for Filebeat modules
This commit is contained in:
@@ -26,6 +26,12 @@ filebeatetcdir:
|
||||
- user: 939
|
||||
- group: 939
|
||||
- makedirs: True
|
||||
filebeatmoduledir:
|
||||
file.directory:
|
||||
- name: /opt/so/conf/filebeat/modules
|
||||
- user: root
|
||||
- group: root
|
||||
- makedirs: True
|
||||
filebeatlogdir:
|
||||
file.directory:
|
||||
- name: /opt/so/log/filebeat
|
||||
@@ -55,6 +61,21 @@ filebeatconfsync:
|
||||
- defaults:
|
||||
INPUTS: {{ salt['pillar.get']('filebeat:config:inputs', {}) }}
|
||||
OUTPUT: {{ salt['pillar.get']('filebeat:config:output', {}) }}
|
||||
# Filebeat module config file
|
||||
filebeatmoduleconfsync:
|
||||
file.managed:
|
||||
- name: /opt/so/conf/filebeat/etc/module-setup.yml
|
||||
- source: salt://filebeat/etc/module-setup.yml
|
||||
- user: root
|
||||
- group: root
|
||||
- template: jinja
|
||||
# Sync Filebeat modules
|
||||
filebeatmodules:
|
||||
file.recurse:
|
||||
- name: /opt/so/conf/filebeat/modules
|
||||
- source: salt://filebeat/modules
|
||||
- user: root
|
||||
- group: root
|
||||
so-filebeat:
|
||||
docker_container.running:
|
||||
- image: {{ MANAGER }}:5000/{{ IMAGEREPO }}/so-filebeat:{{ VERSION }}
|
||||
@@ -65,8 +86,10 @@ so-filebeat:
|
||||
- /nsm:/nsm:ro
|
||||
- /opt/so/log/filebeat:/usr/share/filebeat/logs:rw
|
||||
- /opt/so/conf/filebeat/etc/filebeat.yml:/usr/share/filebeat/filebeat.yml:ro
|
||||
- /opt/so/conf/filebeat/etc/module-setup.yml:/usr/share/filebeat/module-setup.yml:ro
|
||||
- /nsm/wazuh/logs/alerts:/wazuh/alerts:ro
|
||||
- /nsm/wazuh/logs/archives:/wazuh/archives:ro
|
||||
- /opt/so/conf/filebeat/modules:/usr/share/filebeat/modules.d
|
||||
- /opt/so/conf/filebeat/etc/pki/filebeat.crt:/usr/share/filebeat/filebeat.crt:ro
|
||||
- /opt/so/conf/filebeat/etc/pki/filebeat.key:/usr/share/filebeat/filebeat.key:ro
|
||||
- /opt/so/conf/filebeat/registry:/usr/share/filebeat/data/registry:rw
|
||||
|
||||
Reference in New Issue
Block a user