CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2026-04-25 22:17:49 +02:00
Code Issues Packages Projects Releases Wiki Activity

Logstash Module - Fix jinja syntax

Browse Source
This commit is contained in:
Mike Reeves
2018-09-19 15:12:32 -04:00
parent 2376d8e68f
commit 683662bdee
17 changed files with 51 additions and 51 deletions
Download Patch File Download Diff File Expand all files Collapse all files
salt/logstash/files/dynamic/9000_output_bro.conf
+3 -3
View File
@@ -1,5 +1,5 @@
{%- if grains['role'] != 'so-master' %} {%- if grains['role'] != 'so-master' -%}
{%- set ES = salt['pillar.get']('node:mainip', '') %} {%- set ES = salt['pillar.get']('node:mainip', '') -%}
# Author: Justin Henderson # Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics # SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Email: justin@hasecuritysolution.com # Email: justin@hasecuritysolution.com
@@ -17,7 +17,7 @@ output {
if "bro" in [tags] and "test_data" not in [tags] and "import" not in [tags] { if "bro" in [tags] and "test_data" not in [tags] and "import" not in [tags] {
# stdout { codec => rubydebug } # stdout { codec => rubydebug }
elasticsearch { elasticsearch {
hosts => {{ ES }} hosts => "{{ ES }}"
index => "logstash-bro-%{+YYYY.MM.dd}" index => "logstash-bro-%{+YYYY.MM.dd}"
template_name => "logstash" template_name => "logstash"
template => "/logstash-template.json" template => "/logstash-template.json"
salt/logstash/files/dynamic/9001_output_switch.conf
+3 -3
View File
@@ -1,5 +1,5 @@
{%- if grains['role'] != 'so-master' %} {%- if grains['role'] != 'so-master' -%}
{%- set ES = salt['pillar.get']('node:mainip', '') %} {%- set ES = salt['pillar.get']('node:mainip', '') -%}
# Author: Justin Henderson # Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics # SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Email: justin@hasecuritysolution.com # Email: justin@hasecuritysolution.com
@@ -16,7 +16,7 @@ output {
if "switch" in [tags] and "test_data" not in [tags] { if "switch" in [tags] and "test_data" not in [tags] {
#stdout { codec => rubydebug } #stdout { codec => rubydebug }
elasticsearch { elasticsearch {
hosts => {{ ES }} hosts => "{{ ES }}""
index => "logstash-switch-%{+YYYY.MM.dd}" index => "logstash-switch-%{+YYYY.MM.dd}"
template => "/logstash-template.json" template => "/logstash-template.json"
} }
salt/logstash/files/dynamic/9002_output_import.conf
+3 -3
View File
@@ -1,5 +1,5 @@
{%- if grains['role'] != 'so-master' %} {%- if grains['role'] != 'so-master' -%}
{%- set ES = salt['pillar.get']('node:mainip', '') %} {%- set ES = salt['pillar.get']('node:mainip', '') -%}
# Updated by: Doug Burks # Updated by: Doug Burks
# Last Update: 5/16/2017 # Last Update: 5/16/2017
@@ -14,7 +14,7 @@ output {
if "import" in [tags] and "test_data" not in [tags] { if "import" in [tags] and "test_data" not in [tags] {
# stdout { codec => rubydebug } # stdout { codec => rubydebug }
elasticsearch { elasticsearch {
hosts => {{ ES }} hosts => "{{ ES }}""
index => "logstash-import-%{+YYYY.MM.dd}" index => "logstash-import-%{+YYYY.MM.dd}"
template_name => "logstash-*" template_name => "logstash-*"
template => "/logstash-template.json" template => "/logstash-template.json"
salt/logstash/files/dynamic/9004_output_flow.conf
+3 -3
View File
@@ -1,5 +1,5 @@
{%- if grains['role'] != 'so-master' %} {%- if grains['role'] != 'so-master' -%}
{%- set ES = salt['pillar.get']('node:mainip', '') %} {%- set ES = salt['pillar.get']('node:mainip', '') -%}
# Author: Justin Henderson # Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics # SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Email: justin@hasecuritysolution.com # Email: justin@hasecuritysolution.com
@@ -16,7 +16,7 @@ output {
if [event_type] == "sflow" and "test_data" not in [tags] { if [event_type] == "sflow" and "test_data" not in [tags] {
#stdout { codec => rubydebug } #stdout { codec => rubydebug }
elasticsearch { elasticsearch {
hosts => {{ ES }} hosts => "{{ ES }}"
index => "logstash-flow-%{+YYYY.MM.dd}" index => "logstash-flow-%{+YYYY.MM.dd}"
template => "/logstash-template.json" template => "/logstash-template.json"
} }
salt/logstash/files/dynamic/9026_output_dhcp.conf
+3 -3
View File
@@ -1,5 +1,5 @@
{%- if grains['role'] != 'so-master' %} {%- if grains['role'] != 'so-master' -%}
{%- set ES = salt['pillar.get']('node:mainip', '') %} {%- set ES = salt['pillar.get']('node:mainip', '') -%}
# Author: Justin Henderson # Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics # SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Email: justin@hasecuritysolution.com # Email: justin@hasecuritysolution.com
@@ -16,7 +16,7 @@ output {
if [event_type] == "dhcp" and "test_data" not in [tags] { if [event_type] == "dhcp" and "test_data" not in [tags] {
#stdout { codec => rubydebug } #stdout { codec => rubydebug }
elasticsearch { elasticsearch {
hosts => {{ ES }} hosts => "{{ ES }}"
template => "/logstash-template.json" template => "/logstash-template.json"
} }
} }
salt/logstash/files/dynamic/9029_output_esxi.conf
+3 -3
View File
@@ -1,5 +1,5 @@
{%- if grains['role'] != 'so-master' %} {%- if grains['role'] != 'so-master' -%}
{%- set ES = salt['pillar.get']('node:mainip', '') %} {%- set ES = salt['pillar.get']('node:mainip', '') -%}
# Author: Justin Henderson # Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics # SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Email: justin@hasecuritysolution.com # Email: justin@hasecuritysolution.com
@@ -15,7 +15,7 @@ filter {
output { output {
if [event_type] == "esxi" and "test_data" not in [tags] { if [event_type] == "esxi" and "test_data" not in [tags] {
elasticsearch { elasticsearch {
hosts => {{ ES }} hosts => "{{ ES }}"
template => "/logstash-template.json" template => "/logstash-template.json"
} }
} }
salt/logstash/files/dynamic/9030_output_greensql.conf
+3 -3
View File
@@ -1,5 +1,5 @@
{%- if grains['role'] != 'so-master' %} {%- if grains['role'] != 'so-master' -%}
{%- set ES = salt['pillar.get']('node:mainip', '') %} {%- set ES = salt['pillar.get']('node:mainip', '') -%}
# Author: Justin Henderson # Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics # SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Email: justin@hasecuritysolution.com # Email: justin@hasecuritysolution.com
@@ -15,7 +15,7 @@ filter {
output { output {
if [event_type] == "greensql" and "test_data" not in [tags] { if [event_type] == "greensql" and "test_data" not in [tags] {
elasticsearch { elasticsearch {
hosts => {{ ES }} hosts => "{{ ES }}"
template => "/logstash-template.json" template => "/logstash-template.json"
} }
} }
salt/logstash/files/dynamic/9031_output_iis.conf
+3 -3
View File
@@ -1,5 +1,5 @@
{%- if grains['role'] != 'so-master' %} {%- if grains['role'] != 'so-master' -%}
{%- set ES = salt['pillar.get']('node:mainip', '') %} {%- set ES = salt['pillar.get']('node:mainip', '') -%}
# Author: Justin Henderson # Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics # SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Email: justin@hasecuritysolution.com # Email: justin@hasecuritysolution.com
@@ -16,7 +16,7 @@ output {
if [event_type] == "iis" and "test_data" not in [tags] { if [event_type] == "iis" and "test_data" not in [tags] {
#stdout { codec => rubydebug } #stdout { codec => rubydebug }
elasticsearch { elasticsearch {
hosts => {{ ES }} hosts => "{{ ES }}"
template => "/logstash-template.json" template => "/logstash-template.json"
} }
} }
salt/logstash/files/dynamic/9032_output_mcafee.conf
+3 -3
View File
@@ -1,5 +1,5 @@
{%- if grains['role'] != 'so-master' %} {%- if grains['role'] != 'so-master' -%}
{%- set ES = salt['pillar.get']('node:mainip', '') %} {%- set ES = salt['pillar.get']('node:mainip', '') -%}
# Author: Justin Henderson # Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics # SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Email: justin@hasecuritysolution.com # Email: justin@hasecuritysolution.com
@@ -16,7 +16,7 @@ output {
if [event_type] == "mcafee" and "test_data" not in [tags] { if [event_type] == "mcafee" and "test_data" not in [tags] {
#stdout { codec => rubydebug } #stdout { codec => rubydebug }
elasticsearch { elasticsearch {
hosts => {{ ES }} hosts => "{{ ES }}"
template => "/logstash-template.json" template => "/logstash-template.json"
} }
} }
salt/logstash/files/dynamic/9033_output_snort.conf
+3 -3
View File
@@ -1,5 +1,5 @@
{%- if grains['role'] != 'so-master' %} {%- if grains['role'] != 'so-master' -%}
{%- set ES = salt['pillar.get']('node:mainip', '') %} {%- set ES = salt['pillar.get']('node:mainip', '') -%}
# Author: Justin Henderson # Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics # SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Email: justin@hasecuritysolution.com # Email: justin@hasecuritysolution.com
@@ -16,7 +16,7 @@ output {
if [event_type] == "snort" and "test_data" not in [tags] { if [event_type] == "snort" and "test_data" not in [tags] {
#stdout { codec => rubydebug } #stdout { codec => rubydebug }
elasticsearch { elasticsearch {
hosts => {{ ES }} hosts => "{{ ES }}"
index => "logstash-ids-%{+YYYY.MM.dd}" index => "logstash-ids-%{+YYYY.MM.dd}"
template_name => "logstash" template_name => "logstash"
template => "/logstash-template.json" template => "/logstash-template.json"
salt/logstash/files/dynamic/9034_output_syslog.conf
+3 -3
View File
@@ -1,5 +1,5 @@
{%- if grains['role'] != 'so-master' %} {%- if grains['role'] != 'so-master' -%}
{%- set ES = salt['pillar.get']('node:mainip', '') %} {%- set ES = salt['pillar.get']('node:mainip', '') -%}
# Author: Justin Henderson # Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics # SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Updated by: Doug Burks # Updated by: Doug Burks
@@ -15,7 +15,7 @@ filter {
output { output {
if "syslog" in [tags] and "test_data" not in [tags] { if "syslog" in [tags] and "test_data" not in [tags] {
elasticsearch { elasticsearch {
hosts => {{ ES }} hosts => "{{ ES }}"
index => "logstash-syslog-%{+YYYY.MM.dd}" index => "logstash-syslog-%{+YYYY.MM.dd}"
template_name => "logstash" template_name => "logstash"
template => "/logstash-template.json" template => "/logstash-template.json"
salt/logstash/files/dynamic/9200_output_firewall.conf
+3 -3
View File
@@ -1,5 +1,5 @@
{%- if grains['role'] != 'so-master' %} {%- if grains['role'] != 'so-master' -%}
{%- set ES = salt['pillar.get']('node:mainip', '') %} {%- set ES = salt['pillar.get']('node:mainip', '') -%}
# Author: Justin Henderson # Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics # SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Email: justin@hasecuritysolution.com # Email: justin@hasecuritysolution.com
@@ -16,7 +16,7 @@ output {
if "firewall" in [tags] and "test_data" not in [tags] { if "firewall" in [tags] and "test_data" not in [tags] {
# stdout { codec => rubydebug } # stdout { codec => rubydebug }
elasticsearch { elasticsearch {
hosts => {{ ES }} hosts => "{{ ES }}"
index => "logstash-firewall-%{+YYYY.MM.dd}" index => "logstash-firewall-%{+YYYY.MM.dd}"
template_name => "logstash" template_name => "logstash"
template => "/logstash-template.json" template => "/logstash-template.json"
salt/logstash/files/dynamic/9300_output_windows.conf
+3 -3
View File
@@ -1,5 +1,5 @@
{%- if grains['role'] != 'so-master' %} {%- if grains['role'] != 'so-master' -%}
{%- set ES = salt['pillar.get']('node:mainip', '') %} {%- set ES = salt['pillar.get']('node:mainip', '') -%}
# Author: Justin Henderson # Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics # SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Email: justin@hasecuritysolution.com # Email: justin@hasecuritysolution.com
@@ -16,7 +16,7 @@ output {
if [event_type] == "windows" and "test_data" not in [tags] { if [event_type] == "windows" and "test_data" not in [tags] {
#stdout { codec => rubydebug } #stdout { codec => rubydebug }
elasticsearch { elasticsearch {
hosts => {{ ES }} hosts => "{{ ES }}"
index => "logstash-windows-%{+YYYY.MM.dd}" index => "logstash-windows-%{+YYYY.MM.dd}"
template => "/logstash-template.json" template => "/logstash-template.json"
} }
salt/logstash/files/dynamic/9301_output_dns_windows.conf
+3 -3
View File
@@ -1,5 +1,5 @@
{%- if grains['role'] != 'so-master' %} {%- if grains['role'] != 'so-master' -%}
{%- set ES = salt['pillar.get']('node:mainip', '') %} {%- set ES = salt['pillar.get']('node:mainip', '') -%}
# Author: Justin Henderson # Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics # SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Email: justin@hasecuritysolution.com # Email: justin@hasecuritysolution.com
@@ -16,7 +16,7 @@ output {
if [event_type] == "dns" and "test_data" not in [tags] { if [event_type] == "dns" and "test_data" not in [tags] {
#stdout { codec => rubydebug } #stdout { codec => rubydebug }
elasticsearch { elasticsearch {
hosts => {{ ES }} hosts => "{{ ES }}"
index => "logstash-%{+YYYY.MM.dd}" index => "logstash-%{+YYYY.MM.dd}"
template => "/logstash-template.json" template => "/logstash-template.json"
} }
salt/logstash/files/dynamic/9400_output_suricata.conf
+3 -3
View File
@@ -1,5 +1,5 @@
{%- if grains['role'] != 'so-master' %} {%- if grains['role'] != 'so-master' -%}
{%- set ES = salt['pillar.get']('node:mainip', '') %} {%- set ES = salt['pillar.get']('node:mainip', '') -%}
# Author: Justin Henderson # Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics # SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Email: justin@hasecuritysolution.com # Email: justin@hasecuritysolution.com
@@ -16,7 +16,7 @@ output {
if [event_type] == "suricata" and "test_data" not in [tags] { if [event_type] == "suricata" and "test_data" not in [tags] {
#stdout { codec => rubydebug } #stdout { codec => rubydebug }
elasticsearch { elasticsearch {
hosts => {{ ES }} hosts => "{{ ES }}"
index => "logstash-ids-%{+YYYY.MM.dd}" index => "logstash-ids-%{+YYYY.MM.dd}"
template => "/logstash-template.json" template => "/logstash-template.json"
} }
salt/logstash/files/dynamic/9500_output_beats.conf
+3 -3
View File
@@ -1,5 +1,5 @@
{%- if grains['role'] != 'so-master' %} {%- if grains['role'] != 'so-master' -%}
{%- set ES = salt['pillar.get']('node:mainip', '') %} {%- set ES = salt['pillar.get']('node:mainip', '') -%}
# Author: Wes Lambert # Author: Wes Lambert
# Last Update: 12/11/2017 # Last Update: 12/11/2017
filter { filter {
@@ -12,7 +12,7 @@ filter {
output { output {
if "beat" in [tags] { if "beat" in [tags] {
elasticsearch { elasticsearch {
hosts => {{ ES }} hosts => "{{ ES }}"
index => "logstash-beats-%{+YYYY.MM.dd}" index => "logstash-beats-%{+YYYY.MM.dd}"
template_name => "logstash-beats" template_name => "logstash-beats"
template => "/beats-template.json" template => "/beats-template.json"
salt/logstash/files/dynamic/9998_output_test_data.conf
+3 -3
View File
@@ -1,5 +1,5 @@
{%- if grains['role'] != 'so-master' %} {%- if grains['role'] != 'so-master' -%}
{%- set ES = salt['pillar.get']('node:mainip', '') %} {%- set ES = salt['pillar.get']('node:mainip', '') -%}
# Author: Justin Henderson # Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics # SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Email: justin@hasecuritysolution.com # Email: justin@hasecuritysolution.com
@@ -15,7 +15,7 @@ filter {
output { output {
if "test_data" in [tags] { if "test_data" in [tags] {
elasticsearch { elasticsearch {
hosts => {{ ES }} hosts => "{{ ES }}"
index => "logstash-test-%{+YYYY.MM.dd}" index => "logstash-test-%{+YYYY.MM.dd}"
template => "/logstash-template.json" template => "/logstash-template.json"
} }