Merge pull request #5961 from Security-Onion-Solutions/issue/5960

Issue/5960

salt/telegraf/etc/telegraf.conf

@@ -673,9 +673,22 @@
 #   ## Use TLS but skip chain & host verification
 #   # insecure_skip_verify = false
 
+{% if grains.role in ['so-node','so-standalone','so-manager', 'so-managersearch', 'so-heavynode'] -%}
+[[inputs.logstash]]
+  url = "http://localhost:9600"
+  collect = ["pipelines"]
+  {%- if salt['pillar.get']('elasticsearch:auth:enabled') is sameas true %}
+  username = "{{ salt['pillar.get']('elasticsearch:auth:users:so_logstash_user:user') }}"
+  password = "{{ salt['pillar.get']('elasticsearch:auth:users:so_logstash_user:pass') }}"
+  {% endif %}
+{%- endif %}
+
+{% if grains.role in ['so-eval','so-standalone','so-manager', 'so-managersearch', 'so-heavynode'] -%}
+[[inputs.redis]]
+  servers = ["tcp://localhost:6379"]
+{%- endif %}
 
 # # Read metrics from one or more commands that can output to stdout
-
 [[inputs.exec]]
    commands = [
       "/scripts/sostatus.sh"