From 441cd3fc5916640f651eb3f4489ea9a9db7b55a0 Mon Sep 17 00:00:00 2001 From: Wes Lambert Date: Wed, 14 Jul 2021 13:42:51 +0000 Subject: [PATCH 1/3] Move Wazuh-specific data to wazuh.data --- salt/elasticsearch/files/ingest/ossec | 1 + 1 file changed, 1 insertion(+) diff --git a/salt/elasticsearch/files/ingest/ossec b/salt/elasticsearch/files/ingest/ossec index 868de2798..69bca3003 100644 --- a/salt/elasticsearch/files/ingest/ossec +++ b/salt/elasticsearch/files/ingest/ossec @@ -33,6 +33,7 @@ { "rename": { "field": "data.win.eventdata.user", "target_field": "user.name", "ignore_missing": true } }, { "rename": { "field": "data.win.system", "target_field": "winlog", "ignore_missing": true } }, { "rename": { "field": "data.win.eventdata", "target_field": "winlog.event_data", "ignore_missing": true } }, + { "rename": { "field": "data", "target_field": "wazuh.data", "ignore_missing": true } }, { "rename": { "field": "winlog.eventID", "target_field": "winlog.event_id", "ignore_missing": true } }, { "rename": { "field": "predecoder.program_name", "target_field": "process.name", "ignore_missing": true } }, { "rename": { "field": "decoder.name", "target_field": "event.dataset", "ignore_missing": true } }, From 323b5d6694d698412227557e1cf18c282bcd92f6 Mon Sep 17 00:00:00 2001 From: Wes Lambert Date: Wed, 14 Jul 2021 13:43:34 +0000 Subject: [PATCH 2/3] Add dynamic mapping for wazuh --- salt/elasticsearch/templates/so/so-common-template.json | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/salt/elasticsearch/templates/so/so-common-template.json b/salt/elasticsearch/templates/so/so-common-template.json index 26a5f2ec7..8ac94793b 100644 --- a/salt/elasticsearch/templates/so/so-common-template.json +++ b/salt/elasticsearch/templates/so/so-common-template.json @@ -680,6 +680,10 @@ "redis":{ "type":"object", "dynamic": true + }, + "wazuh":{ + "type":"object", + "dynamic": true } } } From 723172bc1fe31c1f262f8bf599d98735cf19ff15 Mon Sep 17 00:00:00 2001 From: Wes Lambert Date: Wed, 14 Jul 2021 13:45:09 +0000 Subject: [PATCH 3/3] Add path_unmatch for data.port so it is not mapped as integer --- salt/elasticsearch/templates/so/so-common-template.json | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/salt/elasticsearch/templates/so/so-common-template.json b/salt/elasticsearch/templates/so/so-common-template.json index 8ac94793b..8afac271c 100644 --- a/salt/elasticsearch/templates/so/so-common-template.json +++ b/salt/elasticsearch/templates/so/so-common-template.json @@ -65,7 +65,8 @@ { "port": { "path_match": "*.port", - "mapping": { + "path_unmatch": "*.data.port", + "mapping": { "type": "integer", "fields" : { "keyword" : {