CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-18 23:13:20 +01:00
Code Issues Packages Projects Releases Wiki Activity

initial logstash input from kafka over ssl

Browse Source 
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>
This commit is contained in:
reyesj2
2024-04-05 13:37:14 -04:00
parent 433309ef1a
commit 721e04f793
3 changed files with 89 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files

55
salt/logstash/pipelines/config/so/0800_input_kafka.conf.jinja
View File

@@ -1,26 +1,31 @@
{% set kafka_brokers = salt['pillar.get']('logstash:nodes:kafkanode', {}) %}
{% set broker_ips = [] %}
{% for node, node_data in kafka_brokers.items() %}
{% do broker_ips.append(node_data['ip'] + ":9092") %}
{% endfor %}
{% set bootstrap_servers = "','".join(broker_ips) %}
#Run on searchnodes ingest kafka topic(s) group_id allows load balancing of event ingest to all searchnodes
input {
kafka {
codec => json
#Can ingest multiple topics. Set to a value from SOC UI?
topics => ['logstash-topic',]
group_id => 'searchnodes'
security_protocol => 'SSL'
bootstrap_servers => {{ bootstrap_servers }}
ssl_keystore_location => '/usr/share/logstash/kafka-logstash.p12'
ssl_keystore_password => ''
ssl_keystore_type => 'PKCS12'
ssl_truststore_location => '/etc/pki/ca-trust/extracted/java/cacerts'
# Set password as a pillar to avoid bad optics? This is default truststore for grid
ssl_truststore_password => 'changeit'
}
{% set kafka_brokers = salt['pillar.get']('logstash:nodes:kafkanode', {}) %}
{% set kafka_on_mngr = salt ['pillar.get']('logstash:nodes:manager', {}) %}
{% set broker_ips = [] %}
{% for node, node_data in kafka_brokers.items() %}
{% do broker_ips.append(node_data['ip'] + ":9092") %}
{% endfor %}
{# For testing kafka stuff from manager not dedicated kafkanodes #}
{% for node, node_data in kafka_on_mngr.items() %}
{% do broker_ips.append(node_data['ip'] + ":9092") %}
{% endfor %}
{% set bootstrap_servers = "','".join(broker_ips) %}
#Run on searchnodes ingest kafka topic(s) group_id allows load balancing of event ingest to all searchnodes
input {
kafka {
codec => json
#Can ingest multiple topics. Set to a value from SOC UI?
topics => ['ea-logs']
group_id => 'searchnodes'
security_protocol => 'SSL'
bootstrap_servers => '{{ bootstrap_servers }}'
ssl_keystore_location => '/usr/share/logstash/kafka-logstash.p12'
ssl_keystore_password => 'changeit'
ssl_keystore_type => 'PKCS12'
ssl_truststore_location => '/etc/pki/ca-trust/extracted/java/cacerts'
# Set password as a pillar to avoid bad optics? This is default truststore for grid
ssl_truststore_password => 'changeit'
}
}