mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2025-12-23 17:33:10 +01:00
Initial support - external beats
This commit is contained in:
6
salt/logstash/pipelines/config/so/0009_input_beats.conf
Normal file
6
salt/logstash/pipelines/config/so/0009_input_beats.conf
Normal file
@@ -0,0 +1,6 @@
|
||||
input {
|
||||
beats {
|
||||
port => "5044"
|
||||
tags => [ "beat-ext" ]
|
||||
}
|
||||
}
|
||||
@@ -3,22 +3,15 @@
|
||||
{%- else %}
|
||||
{%- set ES = salt['pillar.get']('node:mainip', '') -%}
|
||||
{%- endif %}
|
||||
# Author: Wes Lambert
|
||||
# Last Update: 09/14/2018
|
||||
filter {
|
||||
if "beat" in [tags] {
|
||||
mutate {
|
||||
##add_tag => [ "conf_file_9500"]
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
output {
|
||||
if "beat" in [tags] {
|
||||
if "beat-ext" in [tags] {
|
||||
elasticsearch {
|
||||
pipeline => "beats.common"
|
||||
hosts => "{{ ES }}"
|
||||
index => "so-beats-%{+YYYY.MM.dd}"
|
||||
template_name => "so-beats"
|
||||
template => "/so-beats-template.json"
|
||||
template_name => "so-common"
|
||||
template => "/so-common-template.json"
|
||||
template_overwrite => true
|
||||
}
|
||||
}
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
Reference in New Issue
Block a user