CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 17:22:49 +01:00
Code Issues Packages Projects Releases Wiki Activity

extra_hosts and redis_input for logstash

Browse Source
This commit is contained in:
m0duspwnens
2021-12-14 18:49:30 -05:00
parent 4da017d61c
commit 55b74abcc5
3 changed files with 27 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
salt/logstash/init.sls
View File

@@ -36,13 +36,14 @@
{% set DOCKER_OPTIONS = salt['pillar.get']('logstash:docker_options', {}) %} {% set DOCKER_OPTIONS = salt['pillar.get']('logstash:docker_options', {}) %}
{% set TEMPLATES = salt['pillar.get']('elasticsearch:templates', {}) %} {% set TEMPLATES = salt['pillar.get']('elasticsearch:templates', {}) %}
{% if grains.role in ['so-heavynode', 'so-receiver'] %} {# if grains.role in ['so-heavynode', 'so-receiver'] %}
{% set EXTRAHOSTHOSTNAME = salt['grains.get']('host') %} {% set EXTRAHOSTHOSTNAME = salt['grains.get']('host') %}
{% set EXTRAHOSTIP = salt['grains.get']('ip_interfaces').get(salt['pillar.get']('host:mainint'))[0] %} {% set EXTRAHOSTIP = salt['grains.get']('ip_interfaces').get(salt['pillar.get']('host:mainint'))[0] %}
{% else %} {% else %}
{% set EXTRAHOSTHOSTNAME = MANAGER %} {% set EXTRAHOSTHOSTNAME = MANAGER %}
{% set EXTRAHOSTIP = MANAGERIP %} {% set EXTRAHOSTIP = MANAGERIP %}
{% endif %} {% endif #}
{% from 'logstash/map.jinja' import EXTRA_HOSTS with context %}
include: include:
- ssl - ssl
@@ -155,8 +156,7 @@ so-logstash:
- hostname: so-logstash - hostname: so-logstash
- name: so-logstash - name: so-logstash
- user: logstash - user: logstash
- extra_hosts: - extra_hosts: {{ EXTRA_HOSTS }}
- {{ EXTRAHOSTHOSTNAME }}:{{ EXTRAHOSTIP }}
- environment: - environment:
- LS_JAVA_OPTS=-Xms{{ lsheap }} -Xmx{{ lsheap }} - LS_JAVA_OPTS=-Xms{{ lsheap }} -Xmx{{ lsheap }}
- port_bindings: - port_bindings:

16
salt/logstash/map.jinja Normal file
View File

@@ -0,0 +1,16 @@
{% set role = grains.role %}
{% set EXTRA_HOSTS = [] %}
{% set mainint = salt['pillar.get']('host:mainint') %}
{% set localhostip = salt['grains.get']('ip_interfaces').get(mainint)[0] %}
{% if role in ['so-node'] %}
{% set node_data = salt['pillar.get']('logstash:nodes') %}
{% for node_type, node_details in node_data.items() | sort %}
{% if node_type in ['manager', 'managersearch', 'standalone', 'receiver' ] %}
{% for hostname in node_data[node_type].keys() %}
{% do EXTRA_HOSTS.append({hostname:node_details[hostname].ip}) %}
{% endfor %}
{% endif %}
{% endfor %}
{% else %}
{% do EXTRA_HOSTS.append({grains.host:localhostip}) %}
{% endif %}

14
salt/logstash/pipelines/config/so/0900_input_redis.conf.jinja
View File

@@ -1,13 +1,12 @@
{%- if grains.role in ['so-heavynode'] %} {%- set THREADS = salt['pillar.get']('logstash_settings:ls_input_threads', '') %}
{%- set HOST = salt['grains.get']('host') %}
{%- else %}
{%- set HOST = salt['grains.get']('master') %}
{%- endif %}
{%- set THREADS = salt['pillar.get']('logstash_settings:ls_input_threads', '') %}
{%- set BATCH = salt['pillar.get']('logstash_settings:ls_pipeline_batch_size', 125) %} {%- set BATCH = salt['pillar.get']('logstash_settings:ls_pipeline_batch_size', 125) %}
{%- from 'logstash/map.jinja' import EXTRA_HOSTS with context %}
{%- for host in EXTRA_HOSTS.keys %}
input { input {
redis { redis {
host => '{{ HOST }}' host => '{{ host }}'
port => 9696 port => 9696
ssl => true ssl => true
data_type => 'list' data_type => 'list'
@@ -17,3 +16,4 @@ input {
batch_count => {{ BATCH }} batch_count => {{ BATCH }}
} }
} }
{%- endfor %}