Fix reference for file mappings in template

2025-12-06 09:12:45 +01:00 · 2022-02-04 18:11:03 +00:00
parent 898db542bf
commit 5e03b1a5de
46 changed files with 54 additions and 4 deletions
--- a/salt/elasticsearch/templates/index/so/so-aws-template.json.jinja
+++ b/salt/elasticsearch/templates/index/so/so-aws-template.json.jinja
@@ -58,6 +58,7 @@
          "error-mappings",
          "event-mappings",
          "dtc-event-mappings",
+          "file-mappings",
          "dtc-file-mappings",
          "group-mappings",
          "host-mappings",
--- a/salt/elasticsearch/templates/index/so/so-azure-template.json.jinja
+++ b/salt/elasticsearch/templates/index/so/so-azure-template.json.jinja
@@ -58,6 +58,7 @@
          "error-mappings",
          "event-mappings",
          "dtc-event-mappings",
+          "file-mappings",
          "dtc-file-mappings",
          "group-mappings",
          "host-mappings",
--- a/salt/elasticsearch/templates/index/so/so-barracuda-template.json.jinja
+++ b/salt/elasticsearch/templates/index/so/so-barracuda-template.json.jinja
@@ -58,6 +58,7 @@
          "error-mappings",
          "event-mappings",
          "dtc-event-mappings",
+          "file-mappings",
          "dtc-file-mappings",
          "group-mappings",
          "host-mappings",
--- a/salt/elasticsearch/templates/index/so/so-beats-template.json.jinja
+++ b/salt/elasticsearch/templates/index/so/so-beats-template.json.jinja
@@ -58,6 +58,7 @@
          "error-mappings",
          "event-mappings",
          "dtc-event-mappings",
+          "file-mappings",
          "dtc-file-mappings",
          "group-mappings",
          "host-mappings",
@@ -93,7 +94,8 @@
          "vulnerability-mappings",
          "common-settings",
          "common-dynamic-mappings",
-          "winlog-mappings"
+          "winlog-mappings",
+          "so-winlog-mappings"
        ],
        "priority": {{ PRIORITY }},
        "_meta": {
--- a/salt/elasticsearch/templates/index/so/so-bluecoat-template.json.jinja
+++ b/salt/elasticsearch/templates/index/so/so-bluecoat-template.json.jinja
@@ -58,6 +58,7 @@
          "error-mappings",
          "event-mappings",
          "dtc-event-mappings",
+          "file-mappings",
          "dtc-file-mappings",
          "group-mappings",
          "host-mappings",
--- a/salt/elasticsearch/templates/index/so/so-cef-template.json.jinja
+++ b/salt/elasticsearch/templates/index/so/so-cef-template.json.jinja
@@ -58,6 +58,7 @@
          "error-mappings",
          "event-mappings",
          "dtc-event-mappings",
+          "file-mappings",
          "dtc-file-mappings",
          "group-mappings",
          "host-mappings",
--- a/salt/elasticsearch/templates/index/so/so-checkpoint-template.json.jinja
+++ b/salt/elasticsearch/templates/index/so/so-checkpoint-template.json.jinja
@@ -58,6 +58,7 @@
          "error-mappings",
          "event-mappings",
          "dtc-event-mappings",
+          "file-mappings",
          "dtc-file-mappings",
          "group-mappings",
          "host-mappings",
--- a/salt/elasticsearch/templates/index/so/so-cisco-template.json.jinja
+++ b/salt/elasticsearch/templates/index/so/so-cisco-template.json.jinja
@@ -59,6 +59,7 @@
          "error-mappings",
          "event-mappings",
          "dtc-event-mappings",
+          "file-mappings",
          "dtc-file-mappings",
          "group-mappings",
          "host-mappings",
--- a/salt/elasticsearch/templates/index/so/so-cyberark-template.json.jinja
+++ b/salt/elasticsearch/templates/index/so/so-cyberark-template.json.jinja
@@ -58,6 +58,7 @@
          "error-mappings",
          "event-mappings",
          "dtc-event-mappings",
+          "file-mappings",
          "dtc-file-mappings",
          "group-mappings",
          "host-mappings",
--- a/salt/elasticsearch/templates/index/so/so-cylance-template.json.jinja
+++ b/salt/elasticsearch/templates/index/so/so-cylance-template.json.jinja
@@ -58,6 +58,7 @@
          "error-mappings",
          "event-mappings",
          "dtc-event-mappings",
+          "file-mappings",
          "dtc-file-mappings",
          "group-mappings",
          "host-mappings",
--- a/salt/elasticsearch/templates/index/so/so-elasticsearch-template.json.jinja
+++ b/salt/elasticsearch/templates/index/so/so-elasticsearch-template.json.jinja
@@ -58,6 +58,7 @@
          "error-mappings",
          "event-mappings",
          "dtc-event-mappings",
+          "file-mappings",
          "dtc-file-mappings",
          "group-mappings",
          "host-mappings",
--- a/salt/elasticsearch/templates/index/so/so-endgame-template.json.jinja
+++ b/salt/elasticsearch/templates/index/so/so-endgame-template.json.jinja
@@ -56,9 +56,10 @@
          "ecs-mappings",
          "dtc-ecs-mappings",
          "endgame-mappings",
-	  "error-mappings",
+          "error-mappings",
          "event-mappings",
          "dtc-event-mappings",
+          "file-mappings",
          "dtc-file-mappings",
          "group-mappings",
          "host-mappings",
--- a/salt/elasticsearch/templates/index/so/so-f5-template.json.jinja
+++ b/salt/elasticsearch/templates/index/so/so-f5-template.json.jinja
@@ -58,6 +58,7 @@
          "error-mappings",
          "event-mappings",
          "dtc-event-mappings",
+          "file-mappings",
          "dtc-file-mappings",
          "group-mappings",
          "host-mappings",
--- a/salt/elasticsearch/templates/index/so/so-firewall-template.json.jinja
+++ b/salt/elasticsearch/templates/index/so/so-firewall-template.json.jinja
@@ -58,6 +58,7 @@
          "error-mappings",
          "event-mappings",
          "dtc-event-mappings",
+          "file-mappings",
          "dtc-file-mappings",
          "group-mappings",
          "host-mappings",
--- a/salt/elasticsearch/templates/index/so/so-flow-template.json.jinja
+++ b/salt/elasticsearch/templates/index/so/so-flow-template.json.jinja
@@ -58,6 +58,7 @@
          "error-mappings",
          "event-mappings",
          "dtc-event-mappings",
+          "file-mappings",
          "dtc-file-mappings",
          "group-mappings",
          "host-mappings",
--- a/salt/elasticsearch/templates/index/so/so-fortinet-template.json.jinja
+++ b/salt/elasticsearch/templates/index/so/so-fortinet-template.json.jinja
@@ -58,6 +58,7 @@
          "error-mappings",
          "event-mappings",
          "dtc-event-mappings",
+          "file-mappings",
          "dtc-file-mappings",
          "group-mappings",
          "host-mappings",
--- a/salt/elasticsearch/templates/index/so/so-gcp-template.json.jinja
+++ b/salt/elasticsearch/templates/index/so/so-gcp-template.json.jinja
@@ -58,6 +58,7 @@
          "error-mappings",
          "event-mappings",
          "dtc-event-mappings",
+          "file-mappings",
          "dtc-file-mappings",
          "group-mappings",
          "host-mappings",
--- a/salt/elasticsearch/templates/index/so/so-google_workspace-template.json.jinja
+++ b/salt/elasticsearch/templates/index/so/so-google_workspace-template.json.jinja
@@ -58,6 +58,7 @@
          "error-mappings",
          "event-mappings",
          "dtc-event-mappings",
+          "file-mappings",
          "dtc-file-mappings",
          "group-mappings",
          "host-mappings",
--- a/salt/elasticsearch/templates/index/so/so-ids-template.json.jinja
+++ b/salt/elasticsearch/templates/index/so/so-ids-template.json.jinja
@@ -58,6 +58,7 @@
          "error-mappings",
          "event-mappings",
          "dtc-event-mappings",
+          "file-mappings",
          "dtc-file-mappings",
          "group-mappings",
          "host-mappings",
--- a/salt/elasticsearch/templates/index/so/so-imperva-template.json.jinja
+++ b/salt/elasticsearch/templates/index/so/so-imperva-template.json.jinja
@@ -58,6 +58,7 @@
          "error-mappings",
          "event-mappings",
          "dtc-event-mappings",
+          "file-mappings",
          "dtc-file-mappings",
          "group-mappings",
          "host-mappings",
--- a/salt/elasticsearch/templates/index/so/so-import-template.json.jinja
+++ b/salt/elasticsearch/templates/index/so/so-import-template.json.jinja
@@ -58,6 +58,7 @@
          "error-mappings",
          "event-mappings",
          "dtc-event-mappings",
+          "file-mappings",
          "dtc-file-mappings",
          "group-mappings",
          "host-mappings",
--- a/salt/elasticsearch/templates/index/so/so-infoblox-template.json.jinja
+++ b/salt/elasticsearch/templates/index/so/so-infoblox-template.json.jinja
@@ -58,6 +58,7 @@
          "error-mappings",
          "event-mappings",
          "dtc-event-mappings",
+          "file-mappings",
          "dtc-file-mappings",
          "group-mappings",
          "host-mappings",
--- a/salt/elasticsearch/templates/index/so/so-juniper-template.json.jinja
+++ b/salt/elasticsearch/templates/index/so/so-juniper-template.json.jinja
@@ -58,6 +58,7 @@
          "error-mappings",
          "event-mappings",
          "dtc-event-mappings",
+          "file-mappings",
          "dtc-file-mappings",
          "group-mappings",
          "host-mappings",
--- a/salt/elasticsearch/templates/index/so/so-kibana-template.json.jinja
+++ b/salt/elasticsearch/templates/index/so/so-kibana-template.json.jinja
@@ -58,6 +58,7 @@
          "error-mappings",
          "event-mappings",
          "dtc-event-mappings",
+          "file-mappings",
          "dtc-file-mappings",
          "group-mappings",
          "host-mappings",
--- a/salt/elasticsearch/templates/index/so/so-logstash-template.json.jinja
+++ b/salt/elasticsearch/templates/index/so/so-logstash-template.json.jinja
@@ -58,6 +58,7 @@
          "error-mappings",
          "event-mappings",
          "dtc-event-mappings",
+          "file-mappings",
          "dtc-file-mappings",
          "group-mappings",
          "host-mappings",
--- a/salt/elasticsearch/templates/index/so/so-microsoft-template.json.jinja
+++ b/salt/elasticsearch/templates/index/so/so-microsoft-template.json.jinja
@@ -58,6 +58,7 @@
          "error-mappings",
          "event-mappings",
          "dtc-event-mappings",
+          "file-mappings",
          "dtc-file-mappings",
          "group-mappings",
          "host-mappings",
--- a/salt/elasticsearch/templates/index/so/so-misp-template.json.jinja
+++ b/salt/elasticsearch/templates/index/so/so-misp-template.json.jinja
@@ -58,6 +58,7 @@
          "error-mappings",
          "event-mappings",
          "dtc-event-mappings",
+          "file-mappings",
          "dtc-file-mappings",
          "group-mappings",
          "host-mappings",
--- a/salt/elasticsearch/templates/index/so/so-netflow-template.json.jinja
+++ b/salt/elasticsearch/templates/index/so/so-netflow-template.json.jinja
@@ -58,6 +58,7 @@
          "error-mappings",
          "event-mappings",
          "dtc-event-mappings",
+          "file-mappings",
          "dtc-file-mappings",
          "group-mappings",
          "host-mappings",
--- a/salt/elasticsearch/templates/index/so/so-netscout-template.json.jinja
+++ b/salt/elasticsearch/templates/index/so/so-netscout-template.json.jinja
@@ -58,6 +58,7 @@
          "error-mappings",
          "event-mappings",
          "dtc-event-mappings",
+          "file-mappings",
          "dtc-file-mappings",
          "group-mappings",
          "host-mappings",
--- a/salt/elasticsearch/templates/index/so/so-o365-template.json.jinja
+++ b/salt/elasticsearch/templates/index/so/so-o365-template.json.jinja
@@ -58,6 +58,7 @@
          "error-mappings",
          "event-mappings",
          "dtc-event-mappings",
+          "file-mappings",
          "dtc-file-mappings",
          "group-mappings",
          "host-mappings",
--- a/salt/elasticsearch/templates/index/so/so-okta-template.json.jinja
+++ b/salt/elasticsearch/templates/index/so/so-okta-template.json.jinja
@@ -58,6 +58,7 @@
          "error-mappings",
          "event-mappings",
          "dtc-event-mappings",
+          "file-mappings",
          "dtc-file-mappings",
          "group-mappings",
          "host-mappings",
--- a/salt/elasticsearch/templates/index/so/so-osquery-template.json.jinja
+++ b/salt/elasticsearch/templates/index/so/so-osquery-template.json.jinja
@@ -58,6 +58,7 @@
          "error-mappings",
          "event-mappings",
          "dtc-event-mappings",
+          "file-mappings",
          "dtc-file-mappings",
          "group-mappings",
          "host-mappings",
@@ -93,7 +94,8 @@
          "vulnerability-mappings",
          "common-settings",
          "common-dynamic-mappings",
-	  "winlog-mappings"
+	  "winlog-mappings",
+	  "so-winlog-mappings"
        ],
        "priority": {{ PRIORITY }},
        "_meta": {
--- a/salt/elasticsearch/templates/index/so/so-ossec-template.json.jinja
+++ b/salt/elasticsearch/templates/index/so/so-ossec-template.json.jinja
@@ -58,6 +58,7 @@
          "error-mappings",
          "event-mappings",
          "dtc-event-mappings",
+          "file-mappings",
          "dtc-file-mappings",
          "group-mappings",
          "host-mappings",
@@ -93,7 +94,8 @@
          "vulnerability-mappings",
          "common-settings",
          "common-dynamic-mappings",
-          "winlog-mappings"
+          "winlog-mappings",
+	  "so-winlog-mappings"
        ],
        "priority": {{ PRIORITY }},
        "_meta": {
--- a/salt/elasticsearch/templates/index/so/so-proofpoint-template.json.jinja
+++ b/salt/elasticsearch/templates/index/so/so-proofpoint-template.json.jinja
@@ -58,6 +58,7 @@
          "error-mappings",
          "event-mappings",
          "dtc-event-mappings",
+          "file-mappings",
          "dtc-file-mappings",
          "group-mappings",
          "host-mappings",
--- a/salt/elasticsearch/templates/index/so/so-radware-template.json.jinja
+++ b/salt/elasticsearch/templates/index/so/so-radware-template.json.jinja
@@ -58,6 +58,7 @@
          "error-mappings",
          "event-mappings",
          "dtc-event-mappings",
+          "file-mappings",
          "dtc-file-mappings",
          "group-mappings",
          "host-mappings",
--- a/salt/elasticsearch/templates/index/so/so-redis-template.json.jinja
+++ b/salt/elasticsearch/templates/index/so/so-redis-template.json.jinja
@@ -58,6 +58,7 @@
          "error-mappings",
          "event-mappings",
          "dtc-event-mappings",
+          "file-mappings",
          "dtc-file-mappings",
          "group-mappings",
          "host-mappings",
--- a/salt/elasticsearch/templates/index/so/so-snort-template.json.jinja
+++ b/salt/elasticsearch/templates/index/so/so-snort-template.json.jinja
@@ -58,6 +58,7 @@
          "error-mappings",
          "event-mappings",
          "dtc-event-mappings",
+          "file-mappings",
          "dtc-file-mappings",
          "group-mappings",
          "host-mappings",
--- a/salt/elasticsearch/templates/index/so/so-snyk-template.json.jinja
+++ b/salt/elasticsearch/templates/index/so/so-snyk-template.json.jinja
@@ -58,6 +58,7 @@
          "error-mappings",
          "event-mappings",
          "dtc-event-mappings",
+          "file-mappings",
          "dtc-file-mappings",
          "group-mappings",
          "host-mappings",
--- a/salt/elasticsearch/templates/index/so/so-sonicwall-template.json.jinja
+++ b/salt/elasticsearch/templates/index/so/so-sonicwall-template.json.jinja
@@ -58,6 +58,7 @@ i%- set INDEX_SORTING = salt['pillar.get']('elasticsearch:index_sorting', False)
          "error-mappings",
          "event-mappings",
          "dtc-event-mappings",
+          "file-mappings",
          "dtc-file-mappings",
          "group-mappings",
          "host-mappings",
--- a/salt/elasticsearch/templates/index/so/so-sophos-template.json.jinja
+++ b/salt/elasticsearch/templates/index/so/so-sophos-template.json.jinja
@@ -58,6 +58,7 @@
          "error-mappings",
          "event-mappings",
          "dtc-event-mappings",
+          "file-mappings",
          "dtc-file-mappings",
          "group-mappings",
          "host-mappings",
--- a/salt/elasticsearch/templates/index/so/so-squid-template.json.jinja
+++ b/salt/elasticsearch/templates/index/so/so-squid-template.json.jinja
@@ -58,6 +58,7 @@
          "error-mappings",
          "event-mappings",
          "dtc-event-mappings",
+          "file-mappings",
          "dtc-file-mappings",
          "group-mappings",
          "host-mappings",
--- a/salt/elasticsearch/templates/index/so/so-strelka-template.json.jinja
+++ b/salt/elasticsearch/templates/index/so/so-strelka-template.json.jinja
@@ -58,7 +58,9 @@
          "error-mappings",
          "event-mappings",
          "dtc-event-mappings",
+          "file-mappings",
          "dtc-file-mappings",
+          "so-file-mappings",
          "group-mappings",
          "host-mappings",
          "dtc-host-mappings",
--- a/salt/elasticsearch/templates/index/so/so-syslog-template.json.jinja
+++ b/salt/elasticsearch/templates/index/so/so-syslog-template.json.jinja
@@ -58,6 +58,7 @@
          "error-mappings",
          "event-mappings",
          "dtc-event-mappings",
+          "file-mappings",
          "dtc-file-mappings",
          "group-mappings",
          "host-mappings",
--- a/salt/elasticsearch/templates/index/so/so-tomcat-template.json.jinja
+++ b/salt/elasticsearch/templates/index/so/so-tomcat-template.json.jinja
@@ -58,6 +58,7 @@
          "error-mappings",
          "event-mappings",
          "dtc-event-mappings",
+          "file-mappings",
          "dtc-file-mappings",
          "group-mappings",
          "host-mappings",
--- a/salt/elasticsearch/templates/index/so/so-zeek-template.json.jinja
+++ b/salt/elasticsearch/templates/index/so/so-zeek-template.json.jinja
@@ -58,6 +58,7 @@
          "error-mappings",
          "event-mappings",
          "dtc-event-mappings",
+          "file-mappings",
          "dtc-file-mappings",
          "group-mappings",
          "host-mappings",
--- a/salt/elasticsearch/templates/index/so/so-zscaler-template.json.jinja
+++ b/salt/elasticsearch/templates/index/so/so-zscaler-template.json.jinja
@@ -58,6 +58,7 @@
          "error-mappings",
          "event-mappings",
          "dtc-event-mappings",
+          "file-mappings",
          "dtc-file-mappings",
          "group-mappings",
          "host-mappings",