CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 17:22:49 +01:00
Code Issues Packages Projects Releases Wiki Activity

Use id for doc id if it exists

Browse Source
This commit is contained in:
Josh Brower
2021-12-09 09:16:58 -05:00
parent 892899b7f9
commit 656ea974dc
1 changed files with 32 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

46
salt/logstash/pipelines/config/so/9500_output_beats.conf.jinja
View File

@@ -7,19 +7,37 @@
{%- set ES_PASS = salt['pillar.get']('elasticsearch:auth:users:so_elastic_user:pass', '') %} {%- set ES_PASS = salt['pillar.get']('elasticsearch:auth:users:so_elastic_user:pass', '') %}
output { output {
if "beat-ext" in [tags] and "import" not in [tags] and "filebeat" not in [metadata][pipeline] { if "beat-ext" in [tags] and "import" not in [tags] and "filebeat" not in [metadata][pipeline] {
elasticsearch { if [metadata][_id] {
pipeline => "beats.common" elasticsearch {
hosts => "{{ ES }}" pipeline => "beats.common"
{% if salt['pillar.get']('elasticsearch:auth:enabled') is sameas true %} hosts => "{{ ES }}"
user => "{{ ES_USER }}" {% if salt['pillar.get']('elasticsearch:auth:enabled') is sameas true %}
password => "{{ ES_PASS }}" user => "{{ ES_USER }}"
{% endif %} password => "{{ ES_PASS }}"
index => "so-beats" {% endif %}
template_name => "so-beats" index => "so-beats"
template => "/templates/so-beats-template.json" template_name => "so-beats"
template_overwrite => true template => "/templates/so-beats-template.json"
ssl => true template_overwrite => true
ssl_certificate_verification => false ssl => true
} ssl_certificate_verification => false
document_id => "%{[metadata][_id]}"
}
} else {
elasticsearch {
pipeline => "beats.common"
hosts => "{{ ES }}"
{% if salt['pillar.get']('elasticsearch:auth:enabled') is sameas true %}
user => "{{ ES_USER }}"
password => "{{ ES_PASS }}"
{% endif %}
index => "so-beats"
template_name => "so-beats"
template => "/templates/so-beats-template.json"
template_overwrite => true
ssl => true
ssl_certificate_verification => false
}
} }
}
} }