From 46d572fa8cd8c319be3b59b92bb9c5ebbd72b39d Mon Sep 17 00:00:00 2001
From: Mike Reeves <mike.reeves@securityonionsolutions.com>
Date: Fri, 10 Jul 2020 15:51:12 -0400
Subject: [PATCH] Fix Filebeat spacing

---
 pillar/logstash/eval.sls       | 8 --------
 pillar/logstash/search.sls     | 8 --------
 salt/filebeat/etc/filebeat.yml | 4 ++--
 3 files changed, 2 insertions(+), 18 deletions(-)

diff --git a/pillar/logstash/eval.sls b/pillar/logstash/eval.sls
index 8613200fe..fcdd13bb7 100644
--- a/pillar/logstash/eval.sls
+++ b/pillar/logstash/eval.sls
@@ -18,20 +18,12 @@ logstash:
   templates:
     - so/so-beats-template.json.jinja
     - so/so-common-template.json
-    - so/so-dhcp-template.json.jinja
-    - so/so-dns_windows-template.json.jinja
-    - so/so-esxi-template.json.jinja
     - so/so-firewall-template.json.jinja
     - so/so-flow-template.json.jinja
-    - so/so-greensql-template.json.jinja
     - so/so-ids-template.json.jinja
     - so/so-import-template.json.jinja
-    - so/so-iss-template.json.jinja
-    - so/so-mcafee-template.json.jinja
     - so/so-osquery-template.json.jinja
     - so/so-ossec-template.json.jinja
     - so/so-strelka-template.json.jinja
-    - so/so-switch-template.json.jinja
     - so/so-syslog-template.json.jinja
-    - so/so-windows-template.json.jinja
     - so/so-zeek-template.json.jinja
diff --git a/pillar/logstash/search.sls b/pillar/logstash/search.sls
index 2203b8452..9c069fd20 100644
--- a/pillar/logstash/search.sls
+++ b/pillar/logstash/search.sls
@@ -14,20 +14,12 @@ logstash:
   templates:
     - so/so-beats-template.json.jinja
     - so/so-common-template.json
-    - so/so-dhcp-template.json.jinja
-    - so/so-dns_windows-template.json.jinja
-    - so/so-esxi-template.json.jinja
     - so/so-firewall-template.json.jinja
     - so/so-flow-template.json.jinja
-    - so/so-greensql-template.json.jinja
     - so/so-ids-template.json.jinja
     - so/so-import-template.json.jinja
-    - so/so-iss-template.json.jinja
-    - so/so-mcafee-template.json.jinja
     - so/so-osquery-template.json.jinja
     - so/so-ossec-template.json.jinja
     - so/so-strelka-template.json.jinja
-    - so/so-switch-template.json.jinja
     - so/so-syslog-template.json.jinja
-    - so/so-windows-template.json.jinja
     - so/so-zeek-template.json.jinja
diff --git a/salt/filebeat/etc/filebeat.yml b/salt/filebeat/etc/filebeat.yml
index 77dd29dd9..7b2289095 100644
--- a/salt/filebeat/etc/filebeat.yml
+++ b/salt/filebeat/etc/filebeat.yml
@@ -127,7 +127,7 @@ filebeat.inputs:
       imported: true
   processors:
   - add_tags:
-    tags: [import]
+      tags: [import]
   - dissect:
       tokenizer: "/nsm/import/%{import.id}/zeek/logs/%{import.file}"
       field: "log.file.path"
@@ -167,7 +167,7 @@ filebeat.inputs:
     imported: true 
   processors:
   - add_tags:
-    tags: [import]
+      tags: [import]
   - dissect:
       tokenizer: "/nsm/import/%{import.id}/suricata/%{import.file}"
       field: "log.file.path"