mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2025-12-06 09:12:45 +01:00
Logstash Module - Rework it
This commit is contained in:
@@ -21,13 +21,11 @@
|
|||||||
|
|
||||||
{% elif grains['role'] == 'so-node' %}
|
{% elif grains['role'] == 'so-node' %}
|
||||||
{% set lsheap = salt['pillar.get']('node:lsheap', '') %}
|
{% set lsheap = salt['pillar.get']('node:lsheap', '') %}
|
||||||
{% set lsaccessip = salt['pillar.get']('node:lsaccessip', '') %}
|
|
||||||
{% set nodetype = salt['pillar.get']('node:node_type', 'storage') %}
|
{% set nodetype = salt['pillar.get']('node:node_type', 'storage') %}
|
||||||
|
|
||||||
{% elif grains['role'] == 'so-master' %}
|
{% elif grains['role'] == 'so-master' %}
|
||||||
|
|
||||||
{% set lsheap = salt['pillar.get']('master:lsheap', '') %}
|
{% set lsheap = salt['pillar.get']('master:lsheap', '') %}
|
||||||
{% set lsaccessip = salt['pillar.get']('master:lsaccessip', '') %}
|
|
||||||
{% set freq = salt['pillar.get']('master:freq', '0') %}
|
{% set freq = salt['pillar.get']('master:freq', '0') %}
|
||||||
{% set dstats = salt['pillar.get']('master:domainstats', '0') %}
|
{% set dstats = salt['pillar.get']('master:domainstats', '0') %}
|
||||||
{% set nodetype = salt['grains.get']('role', '') %}
|
{% set nodetype = salt['grains.get']('role', '') %}
|
||||||
@@ -35,7 +33,6 @@
|
|||||||
{% elif grains['role'] == 'so-eval' %}
|
{% elif grains['role'] == 'so-eval' %}
|
||||||
|
|
||||||
{% set lsheap = salt['pillar.get']('master:lsheap', '') %}
|
{% set lsheap = salt['pillar.get']('master:lsheap', '') %}
|
||||||
{% set lsaccessip = salt['pillar.get']('master:lsaccessip', '') %}
|
|
||||||
{% set freq = salt['pillar.get']('master:freq', '0') %}
|
{% set freq = salt['pillar.get']('master:freq', '0') %}
|
||||||
{% set dstats = salt['pillar.get']('master:domainstats', '0') %}
|
{% set dstats = salt['pillar.get']('master:domainstats', '0') %}
|
||||||
{% set nodetype = salt['grains.get']('role', '') %}
|
{% set nodetype = salt['grains.get']('role', '') %}
|
||||||
@@ -63,13 +60,26 @@ lscustdir:
|
|||||||
- group: 939
|
- group: 939
|
||||||
- makedirs: True
|
- makedirs: True
|
||||||
|
|
||||||
|
lsdyndir:
|
||||||
|
file.directory:
|
||||||
|
- name: /opt/so/conf/logstash/dynamic
|
||||||
|
- user: 931
|
||||||
|
- group: 939
|
||||||
|
- makedirs: True
|
||||||
|
|
||||||
|
lsetcdir:
|
||||||
|
file.directory:
|
||||||
|
- name: /opt/so/conf/logstash/etc
|
||||||
|
- user: 931
|
||||||
|
- group: 939
|
||||||
|
- makedirs: True
|
||||||
|
|
||||||
lscustparserdir:
|
lscustparserdir:
|
||||||
file.directory:
|
file.directory:
|
||||||
- name: /opt/so/conf/logstash/custom/parsers
|
- name: /opt/so/conf/logstash/custom/parsers
|
||||||
- user: 931
|
- user: 931
|
||||||
- group: 939
|
- group: 939
|
||||||
- makedirs: True
|
- makedirs: True
|
||||||
- template: jinja
|
|
||||||
|
|
||||||
lscusttemplatedir:
|
lscusttemplatedir:
|
||||||
file.directory:
|
file.directory:
|
||||||
@@ -79,14 +89,29 @@ lscusttemplatedir:
|
|||||||
- makedirs: True
|
- makedirs: True
|
||||||
|
|
||||||
# Copy down all the configs including custom - TODO add watch restart
|
# Copy down all the configs including custom - TODO add watch restart
|
||||||
lssync:
|
lsetcsync:
|
||||||
file.recurse:
|
file.recurse:
|
||||||
- name: /opt/so/conf/logstash
|
- name: /opt/so/conf/logstash/etc
|
||||||
- source: salt://logstash/files
|
- source: salt://logstash/etc
|
||||||
- user: 931
|
- user: 931
|
||||||
- group: 939
|
- group: 939
|
||||||
- template: jinja
|
- template: jinja
|
||||||
|
|
||||||
|
lssync:
|
||||||
|
file.recurse:
|
||||||
|
- name: /opt/so/conf/logstash/dynamic
|
||||||
|
- source: salt://logstash/files/dynamic
|
||||||
|
- user: 931
|
||||||
|
- group: 939
|
||||||
|
- template: jinja
|
||||||
|
|
||||||
|
lscustsync:
|
||||||
|
file.recurse:
|
||||||
|
- name: /opt/so/conf/logstash/custom
|
||||||
|
- source: salt://logstash/files/custom
|
||||||
|
- user: 931
|
||||||
|
- group: 939
|
||||||
|
|
||||||
# Copy the config file for enabled logstash plugins/parsers
|
# Copy the config file for enabled logstash plugins/parsers
|
||||||
lsconfsync:
|
lsconfsync:
|
||||||
file.managed:
|
file.managed:
|
||||||
@@ -139,11 +164,11 @@ so-logstash:
|
|||||||
- 0.0.0.0:6053:6053
|
- 0.0.0.0:6053:6053
|
||||||
- 0.0.0.0:9600:9600
|
- 0.0.0.0:9600:9600
|
||||||
- binds:
|
- binds:
|
||||||
- /opt/so/conf/logstash/log4j2.properties:/usr/share/logstash/config/log4j2.properties:ro
|
- /opt/so/conf/logstash/etc/log4j2.properties:/usr/share/logstash/config/log4j2.properties:ro
|
||||||
- /opt/so/conf/logstash/logstash.yml:/usr/share/logstash/config/logstash.yml:ro
|
- /opt/so/conf/logstash/etc/logstash.yml:/usr/share/logstash/config/logstash.yml:ro
|
||||||
- /opt/so/conf/logstash/logstash-template.json:/logstash-template.json:ro
|
- /opt/so/conf/logstash/etc/logstash-template.json:/logstash-template.json:ro
|
||||||
- /opt/so/conf/logstash/logstash-ossec-template.json:/logstash-ossec-template.json:ro
|
- /opt/so/conf/logstash/etc/logstash-ossec-template.json:/logstash-ossec-template.json:ro
|
||||||
- /opt/so/conf/logstash/beats-template.json:/beats-template.json:ro
|
- /opt/so/conf/logstash/etc/beats-template.json:/beats-template.json:ro
|
||||||
- /opt/so/conf/logstash/custom:/usr/share/logstash/pipeline.custom:ro
|
- /opt/so/conf/logstash/custom:/usr/share/logstash/pipeline.custom:ro
|
||||||
- /opt/so/conf/logstash/rulesets:/usr/share/logstash/rulesets:ro
|
- /opt/so/conf/logstash/rulesets:/usr/share/logstash/rulesets:ro
|
||||||
- /opt/so/conf/logstash/dynamic:/usr/share/logstash/pipeline.dynamic
|
- /opt/so/conf/logstash/dynamic:/usr/share/logstash/pipeline.dynamic
|
||||||
|
|||||||
@@ -1534,7 +1534,7 @@ if (whiptail_you_sure); then
|
|||||||
else
|
else
|
||||||
NODE_ES_HEAP_SIZE=$ES_HEAP_SIZE
|
NODE_ES_HEAP_SIZE=$ES_HEAP_SIZE
|
||||||
NODE_LS_HEAP_SIZE=$LS_HEAP_SIZE
|
NODE_LS_HEAP_SIZE=$LS_HEAP_SIZE
|
||||||
LSPIPELINEWORKERS=1
|
LSPIPELINEWORKERS=$CPUCORES
|
||||||
LSPIPELINEBATCH=125
|
LSPIPELINEBATCH=125
|
||||||
LSINPUTTHREADS=1
|
LSINPUTTHREADS=1
|
||||||
LSINPUTBATCHCOUNT=125
|
LSINPUTBATCHCOUNT=125
|
||||||
|
|||||||
Reference in New Issue
Block a user