CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-17 14:33:11 +01:00
Code Issues Packages Projects Releases Wiki Activity

Logstash - Alter input for Wazuh logs

Browse Source
This commit is contained in:
Wes Lambert
2018-12-12 20:52:18 +00:00
parent 54c35cdc0d
commit 41e9c4c7e0
1 changed files with 2 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
salt/logstash/files/dynamic/0006_input_beats.conf
View File

@@ -9,7 +9,7 @@ input {
}
}
filter {
if [type] == "ids" {
if [type] == "ids" or [type] =~ "bro" {
mutate {
rename => { "host" => "beat_host" }
remove_tag => ["beat"]
@@ -17,11 +17,10 @@ filter {
add_field => { "syslog-host_from" => "%{[beat][name]}" }
}
}
if "bro" in [tags] {
if [type] =~ "ossec" {
mutate {
rename => { "host" => "beat_host" }
remove_tag => ["beat"]
add_field => { "sensor_name" => "%{[beat][name]}" }
add_field => { "syslog-host_from" => "%{[beat][name]}" }
}
}