Merge branch 'dev' into feature/osquery-ingest

salt/filebeat/etc/filebeat.yml

@@ -164,9 +164,10 @@ filebeat.inputs:
 
   - type: log
     paths:
-      - /opt/so/log/strelka/strelka.log
+      - /nsm/strelka/log/strelka.log
     fields:
       module: strelka
+      category: file
       dataset: file
 
     processors:
@@ -197,6 +198,9 @@ output.elasticsearch:
     - index: "so-osquery-%{+yyyy.MM.dd}"
       when.contains:
         module: "osquery"
+    - index: "so-strelka-%{+yyyy.MM.dd}"
+      when.contains:
+        module: "strelka"
 
 #output.logstash:
   # Boolean flag to enable or disable the output module.