From 683662bdee2bfe64dc70bf6a2d4a0f732513f820 Mon Sep 17 00:00:00 2001 From: Mike Reeves Date: Wed, 19 Sep 2018 15:12:32 -0400 Subject: [PATCH] Logstash Module - Fix jinja syntax --- salt/logstash/files/dynamic/9000_output_bro.conf | 6 +++--- salt/logstash/files/dynamic/9001_output_switch.conf | 6 +++--- salt/logstash/files/dynamic/9002_output_import.conf | 6 +++--- salt/logstash/files/dynamic/9004_output_flow.conf | 6 +++--- salt/logstash/files/dynamic/9026_output_dhcp.conf | 6 +++--- salt/logstash/files/dynamic/9029_output_esxi.conf | 6 +++--- salt/logstash/files/dynamic/9030_output_greensql.conf | 6 +++--- salt/logstash/files/dynamic/9031_output_iis.conf | 6 +++--- salt/logstash/files/dynamic/9032_output_mcafee.conf | 6 +++--- salt/logstash/files/dynamic/9033_output_snort.conf | 6 +++--- salt/logstash/files/dynamic/9034_output_syslog.conf | 6 +++--- salt/logstash/files/dynamic/9200_output_firewall.conf | 6 +++--- salt/logstash/files/dynamic/9300_output_windows.conf | 6 +++--- salt/logstash/files/dynamic/9301_output_dns_windows.conf | 6 +++--- salt/logstash/files/dynamic/9400_output_suricata.conf | 6 +++--- salt/logstash/files/dynamic/9500_output_beats.conf | 6 +++--- salt/logstash/files/dynamic/9998_output_test_data.conf | 6 +++--- 17 files changed, 51 insertions(+), 51 deletions(-) diff --git a/salt/logstash/files/dynamic/9000_output_bro.conf b/salt/logstash/files/dynamic/9000_output_bro.conf index 4ed124993..c4119e5de 100644 --- a/salt/logstash/files/dynamic/9000_output_bro.conf +++ b/salt/logstash/files/dynamic/9000_output_bro.conf @@ -1,5 +1,5 @@ -{%- if grains['role'] != 'so-master' %} -{%- set ES = salt['pillar.get']('node:mainip', '') %} +{%- if grains['role'] != 'so-master' -%} +{%- set ES = salt['pillar.get']('node:mainip', '') -%} # Author: Justin Henderson # SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics # Email: justin@hasecuritysolution.com @@ -17,7 +17,7 @@ output { if "bro" in [tags] and "test_data" not in [tags] and "import" not in [tags] { # stdout { codec => rubydebug } elasticsearch { - hosts => {{ ES }} + hosts => "{{ ES }}" index => "logstash-bro-%{+YYYY.MM.dd}" template_name => "logstash" template => "/logstash-template.json" diff --git a/salt/logstash/files/dynamic/9001_output_switch.conf b/salt/logstash/files/dynamic/9001_output_switch.conf index a649dbd2f..820bf8f3f 100644 --- a/salt/logstash/files/dynamic/9001_output_switch.conf +++ b/salt/logstash/files/dynamic/9001_output_switch.conf @@ -1,5 +1,5 @@ -{%- if grains['role'] != 'so-master' %} -{%- set ES = salt['pillar.get']('node:mainip', '') %} +{%- if grains['role'] != 'so-master' -%} +{%- set ES = salt['pillar.get']('node:mainip', '') -%} # Author: Justin Henderson # SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics # Email: justin@hasecuritysolution.com @@ -16,7 +16,7 @@ output { if "switch" in [tags] and "test_data" not in [tags] { #stdout { codec => rubydebug } elasticsearch { - hosts => {{ ES }} + hosts => "{{ ES }}"" index => "logstash-switch-%{+YYYY.MM.dd}" template => "/logstash-template.json" } diff --git a/salt/logstash/files/dynamic/9002_output_import.conf b/salt/logstash/files/dynamic/9002_output_import.conf index 954f6814c..d3512f222 100644 --- a/salt/logstash/files/dynamic/9002_output_import.conf +++ b/salt/logstash/files/dynamic/9002_output_import.conf @@ -1,5 +1,5 @@ -{%- if grains['role'] != 'so-master' %} -{%- set ES = salt['pillar.get']('node:mainip', '') %} +{%- if grains['role'] != 'so-master' -%} +{%- set ES = salt['pillar.get']('node:mainip', '') -%} # Updated by: Doug Burks # Last Update: 5/16/2017 @@ -14,7 +14,7 @@ output { if "import" in [tags] and "test_data" not in [tags] { # stdout { codec => rubydebug } elasticsearch { - hosts => {{ ES }} + hosts => "{{ ES }}"" index => "logstash-import-%{+YYYY.MM.dd}" template_name => "logstash-*" template => "/logstash-template.json" diff --git a/salt/logstash/files/dynamic/9004_output_flow.conf b/salt/logstash/files/dynamic/9004_output_flow.conf index de991d686..ae37961c5 100644 --- a/salt/logstash/files/dynamic/9004_output_flow.conf +++ b/salt/logstash/files/dynamic/9004_output_flow.conf @@ -1,5 +1,5 @@ -{%- if grains['role'] != 'so-master' %} -{%- set ES = salt['pillar.get']('node:mainip', '') %} +{%- if grains['role'] != 'so-master' -%} +{%- set ES = salt['pillar.get']('node:mainip', '') -%} # Author: Justin Henderson # SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics # Email: justin@hasecuritysolution.com @@ -16,7 +16,7 @@ output { if [event_type] == "sflow" and "test_data" not in [tags] { #stdout { codec => rubydebug } elasticsearch { - hosts => {{ ES }} + hosts => "{{ ES }}" index => "logstash-flow-%{+YYYY.MM.dd}" template => "/logstash-template.json" } diff --git a/salt/logstash/files/dynamic/9026_output_dhcp.conf b/salt/logstash/files/dynamic/9026_output_dhcp.conf index 0d3fd8db6..a6bb24850 100644 --- a/salt/logstash/files/dynamic/9026_output_dhcp.conf +++ b/salt/logstash/files/dynamic/9026_output_dhcp.conf @@ -1,5 +1,5 @@ -{%- if grains['role'] != 'so-master' %} -{%- set ES = salt['pillar.get']('node:mainip', '') %} +{%- if grains['role'] != 'so-master' -%} +{%- set ES = salt['pillar.get']('node:mainip', '') -%} # Author: Justin Henderson # SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics # Email: justin@hasecuritysolution.com @@ -16,7 +16,7 @@ output { if [event_type] == "dhcp" and "test_data" not in [tags] { #stdout { codec => rubydebug } elasticsearch { - hosts => {{ ES }} + hosts => "{{ ES }}" template => "/logstash-template.json" } } diff --git a/salt/logstash/files/dynamic/9029_output_esxi.conf b/salt/logstash/files/dynamic/9029_output_esxi.conf index c639aeb1a..d7b37f03e 100644 --- a/salt/logstash/files/dynamic/9029_output_esxi.conf +++ b/salt/logstash/files/dynamic/9029_output_esxi.conf @@ -1,5 +1,5 @@ -{%- if grains['role'] != 'so-master' %} -{%- set ES = salt['pillar.get']('node:mainip', '') %} +{%- if grains['role'] != 'so-master' -%} +{%- set ES = salt['pillar.get']('node:mainip', '') -%} # Author: Justin Henderson # SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics # Email: justin@hasecuritysolution.com @@ -15,7 +15,7 @@ filter { output { if [event_type] == "esxi" and "test_data" not in [tags] { elasticsearch { - hosts => {{ ES }} + hosts => "{{ ES }}" template => "/logstash-template.json" } } diff --git a/salt/logstash/files/dynamic/9030_output_greensql.conf b/salt/logstash/files/dynamic/9030_output_greensql.conf index 4939b8f9c..b8a4ff1ac 100644 --- a/salt/logstash/files/dynamic/9030_output_greensql.conf +++ b/salt/logstash/files/dynamic/9030_output_greensql.conf @@ -1,5 +1,5 @@ -{%- if grains['role'] != 'so-master' %} -{%- set ES = salt['pillar.get']('node:mainip', '') %} +{%- if grains['role'] != 'so-master' -%} +{%- set ES = salt['pillar.get']('node:mainip', '') -%} # Author: Justin Henderson # SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics # Email: justin@hasecuritysolution.com @@ -15,7 +15,7 @@ filter { output { if [event_type] == "greensql" and "test_data" not in [tags] { elasticsearch { - hosts => {{ ES }} + hosts => "{{ ES }}" template => "/logstash-template.json" } } diff --git a/salt/logstash/files/dynamic/9031_output_iis.conf b/salt/logstash/files/dynamic/9031_output_iis.conf index 029ee7b62..0073a18aa 100644 --- a/salt/logstash/files/dynamic/9031_output_iis.conf +++ b/salt/logstash/files/dynamic/9031_output_iis.conf @@ -1,5 +1,5 @@ -{%- if grains['role'] != 'so-master' %} -{%- set ES = salt['pillar.get']('node:mainip', '') %} +{%- if grains['role'] != 'so-master' -%} +{%- set ES = salt['pillar.get']('node:mainip', '') -%} # Author: Justin Henderson # SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics # Email: justin@hasecuritysolution.com @@ -16,7 +16,7 @@ output { if [event_type] == "iis" and "test_data" not in [tags] { #stdout { codec => rubydebug } elasticsearch { - hosts => {{ ES }} + hosts => "{{ ES }}" template => "/logstash-template.json" } } diff --git a/salt/logstash/files/dynamic/9032_output_mcafee.conf b/salt/logstash/files/dynamic/9032_output_mcafee.conf index 28b685646..efaa9ed24 100644 --- a/salt/logstash/files/dynamic/9032_output_mcafee.conf +++ b/salt/logstash/files/dynamic/9032_output_mcafee.conf @@ -1,5 +1,5 @@ -{%- if grains['role'] != 'so-master' %} -{%- set ES = salt['pillar.get']('node:mainip', '') %} +{%- if grains['role'] != 'so-master' -%} +{%- set ES = salt['pillar.get']('node:mainip', '') -%} # Author: Justin Henderson # SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics # Email: justin@hasecuritysolution.com @@ -16,7 +16,7 @@ output { if [event_type] == "mcafee" and "test_data" not in [tags] { #stdout { codec => rubydebug } elasticsearch { - hosts => {{ ES }} + hosts => "{{ ES }}" template => "/logstash-template.json" } } diff --git a/salt/logstash/files/dynamic/9033_output_snort.conf b/salt/logstash/files/dynamic/9033_output_snort.conf index 7a157d09e..a16219494 100644 --- a/salt/logstash/files/dynamic/9033_output_snort.conf +++ b/salt/logstash/files/dynamic/9033_output_snort.conf @@ -1,5 +1,5 @@ -{%- if grains['role'] != 'so-master' %} -{%- set ES = salt['pillar.get']('node:mainip', '') %} +{%- if grains['role'] != 'so-master' -%} +{%- set ES = salt['pillar.get']('node:mainip', '') -%} # Author: Justin Henderson # SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics # Email: justin@hasecuritysolution.com @@ -16,7 +16,7 @@ output { if [event_type] == "snort" and "test_data" not in [tags] { #stdout { codec => rubydebug } elasticsearch { - hosts => {{ ES }} + hosts => "{{ ES }}" index => "logstash-ids-%{+YYYY.MM.dd}" template_name => "logstash" template => "/logstash-template.json" diff --git a/salt/logstash/files/dynamic/9034_output_syslog.conf b/salt/logstash/files/dynamic/9034_output_syslog.conf index 3c1c85ef5..91a99d9b0 100644 --- a/salt/logstash/files/dynamic/9034_output_syslog.conf +++ b/salt/logstash/files/dynamic/9034_output_syslog.conf @@ -1,5 +1,5 @@ -{%- if grains['role'] != 'so-master' %} -{%- set ES = salt['pillar.get']('node:mainip', '') %} +{%- if grains['role'] != 'so-master' -%} +{%- set ES = salt['pillar.get']('node:mainip', '') -%} # Author: Justin Henderson # SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics # Updated by: Doug Burks @@ -15,7 +15,7 @@ filter { output { if "syslog" in [tags] and "test_data" not in [tags] { elasticsearch { - hosts => {{ ES }} + hosts => "{{ ES }}" index => "logstash-syslog-%{+YYYY.MM.dd}" template_name => "logstash" template => "/logstash-template.json" diff --git a/salt/logstash/files/dynamic/9200_output_firewall.conf b/salt/logstash/files/dynamic/9200_output_firewall.conf index 1d1be2381..3e9f658a6 100644 --- a/salt/logstash/files/dynamic/9200_output_firewall.conf +++ b/salt/logstash/files/dynamic/9200_output_firewall.conf @@ -1,5 +1,5 @@ -{%- if grains['role'] != 'so-master' %} -{%- set ES = salt['pillar.get']('node:mainip', '') %} +{%- if grains['role'] != 'so-master' -%} +{%- set ES = salt['pillar.get']('node:mainip', '') -%} # Author: Justin Henderson # SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics # Email: justin@hasecuritysolution.com @@ -16,7 +16,7 @@ output { if "firewall" in [tags] and "test_data" not in [tags] { # stdout { codec => rubydebug } elasticsearch { - hosts => {{ ES }} + hosts => "{{ ES }}" index => "logstash-firewall-%{+YYYY.MM.dd}" template_name => "logstash" template => "/logstash-template.json" diff --git a/salt/logstash/files/dynamic/9300_output_windows.conf b/salt/logstash/files/dynamic/9300_output_windows.conf index 79c6d9f18..a0a1e12c7 100644 --- a/salt/logstash/files/dynamic/9300_output_windows.conf +++ b/salt/logstash/files/dynamic/9300_output_windows.conf @@ -1,5 +1,5 @@ -{%- if grains['role'] != 'so-master' %} -{%- set ES = salt['pillar.get']('node:mainip', '') %} +{%- if grains['role'] != 'so-master' -%} +{%- set ES = salt['pillar.get']('node:mainip', '') -%} # Author: Justin Henderson # SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics # Email: justin@hasecuritysolution.com @@ -16,7 +16,7 @@ output { if [event_type] == "windows" and "test_data" not in [tags] { #stdout { codec => rubydebug } elasticsearch { - hosts => {{ ES }} + hosts => "{{ ES }}" index => "logstash-windows-%{+YYYY.MM.dd}" template => "/logstash-template.json" } diff --git a/salt/logstash/files/dynamic/9301_output_dns_windows.conf b/salt/logstash/files/dynamic/9301_output_dns_windows.conf index f4c74f3a9..871a479b1 100644 --- a/salt/logstash/files/dynamic/9301_output_dns_windows.conf +++ b/salt/logstash/files/dynamic/9301_output_dns_windows.conf @@ -1,5 +1,5 @@ -{%- if grains['role'] != 'so-master' %} -{%- set ES = salt['pillar.get']('node:mainip', '') %} +{%- if grains['role'] != 'so-master' -%} +{%- set ES = salt['pillar.get']('node:mainip', '') -%} # Author: Justin Henderson # SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics # Email: justin@hasecuritysolution.com @@ -16,7 +16,7 @@ output { if [event_type] == "dns" and "test_data" not in [tags] { #stdout { codec => rubydebug } elasticsearch { - hosts => {{ ES }} + hosts => "{{ ES }}" index => "logstash-%{+YYYY.MM.dd}" template => "/logstash-template.json" } diff --git a/salt/logstash/files/dynamic/9400_output_suricata.conf b/salt/logstash/files/dynamic/9400_output_suricata.conf index 328951535..41771e41c 100644 --- a/salt/logstash/files/dynamic/9400_output_suricata.conf +++ b/salt/logstash/files/dynamic/9400_output_suricata.conf @@ -1,5 +1,5 @@ -{%- if grains['role'] != 'so-master' %} -{%- set ES = salt['pillar.get']('node:mainip', '') %} +{%- if grains['role'] != 'so-master' -%} +{%- set ES = salt['pillar.get']('node:mainip', '') -%} # Author: Justin Henderson # SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics # Email: justin@hasecuritysolution.com @@ -16,7 +16,7 @@ output { if [event_type] == "suricata" and "test_data" not in [tags] { #stdout { codec => rubydebug } elasticsearch { - hosts => {{ ES }} + hosts => "{{ ES }}" index => "logstash-ids-%{+YYYY.MM.dd}" template => "/logstash-template.json" } diff --git a/salt/logstash/files/dynamic/9500_output_beats.conf b/salt/logstash/files/dynamic/9500_output_beats.conf index 61b7de4c9..c2bfd529e 100644 --- a/salt/logstash/files/dynamic/9500_output_beats.conf +++ b/salt/logstash/files/dynamic/9500_output_beats.conf @@ -1,5 +1,5 @@ -{%- if grains['role'] != 'so-master' %} -{%- set ES = salt['pillar.get']('node:mainip', '') %} +{%- if grains['role'] != 'so-master' -%} +{%- set ES = salt['pillar.get']('node:mainip', '') -%} # Author: Wes Lambert # Last Update: 12/11/2017 filter { @@ -12,7 +12,7 @@ filter { output { if "beat" in [tags] { elasticsearch { - hosts => {{ ES }} + hosts => "{{ ES }}" index => "logstash-beats-%{+YYYY.MM.dd}" template_name => "logstash-beats" template => "/beats-template.json" diff --git a/salt/logstash/files/dynamic/9998_output_test_data.conf b/salt/logstash/files/dynamic/9998_output_test_data.conf index 8097689e9..87b59db00 100644 --- a/salt/logstash/files/dynamic/9998_output_test_data.conf +++ b/salt/logstash/files/dynamic/9998_output_test_data.conf @@ -1,5 +1,5 @@ -{%- if grains['role'] != 'so-master' %} -{%- set ES = salt['pillar.get']('node:mainip', '') %} +{%- if grains['role'] != 'so-master' -%} +{%- set ES = salt['pillar.get']('node:mainip', '') -%} # Author: Justin Henderson # SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics # Email: justin@hasecuritysolution.com @@ -15,7 +15,7 @@ filter { output { if "test_data" in [tags] { elasticsearch { - hosts => {{ ES }} + hosts => "{{ ES }}" index => "logstash-test-%{+YYYY.MM.dd}" template => "/logstash-template.json" }