From e0570e1db7adfcf41e277d2d458b62e5c5e7a24a Mon Sep 17 00:00:00 2001 From: Wes Lambert Date: Tue, 7 Jul 2020 15:00:01 +0000 Subject: [PATCH 1/2] Add Zeek FUID for Strelka records --- salt/elasticsearch/files/ingest/strelka.file | 1 + 1 file changed, 1 insertion(+) diff --git a/salt/elasticsearch/files/ingest/strelka.file b/salt/elasticsearch/files/ingest/strelka.file index a2e08b799..ed80a4e5b 100644 --- a/salt/elasticsearch/files/ingest/strelka.file +++ b/salt/elasticsearch/files/ingest/strelka.file @@ -6,6 +6,7 @@ { "rename": { "field": "message2.scan", "target_field": "scan", "ignore_missing": true } }, { "rename": { "field": "message2.request", "target_field": "request", "ignore_missing": true } }, { "rename": { "field": "scan.hash", "target_field": "hash", "ignore_missing": true } }, + { "grok": { "field": "request.attributes.filename", "patterns": ["-%{WORD:log.id.fuid}-"] } }, { "remove": { "field": ["host", "path"], "ignore_missing": true } }, { "pipeline": { "name": "common" } } ] From ec89ab39ac58ae3c02441058c51194516a87ef0e Mon Sep 17 00:00:00 2001 From: Mike Reeves Date: Tue, 7 Jul 2020 11:56:45 -0400 Subject: [PATCH 2/2] Update 9999_output_redis.conf.jinja --- salt/logstash/pipelines/config/so/9999_output_redis.conf.jinja | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/salt/logstash/pipelines/config/so/9999_output_redis.conf.jinja b/salt/logstash/pipelines/config/so/9999_output_redis.conf.jinja index 5bf2512d5..b50f72747 100644 --- a/salt/logstash/pipelines/config/so/9999_output_redis.conf.jinja +++ b/salt/logstash/pipelines/config/so/9999_output_redis.conf.jinja @@ -8,7 +8,7 @@ output { key => 'logstash:unparsed' congestion_interval => 1 congestion_threshold => 50000000 - batch ==> True + batch => True batch_events => {{ BATCH }} } }