CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-08 10:12:53 +01:00
Code Issues Packages Projects Releases Wiki Activity

update Logstash config

Browse Source
This commit is contained in:
Wes Lambert
2020-06-02 17:36:36 +00:00
parent 91673a5d70
commit 8cac30728b
2 changed files with 7 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
pillar/logstash/search.sls
View File

@@ -5,6 +5,7 @@ logstash:
- so/0900_input_redis.conf.jinja - so/0900_input_redis.conf.jinja
- so/9000_output_zeek.conf.jinja - so/9000_output_zeek.conf.jinja
- so/9002_output_import.conf.jinja - so/9002_output_import.conf.jinja
- so/9034_output_syslog.conf.jinja
- so/9100_output_osquery.conf.jinja - so/9100_output_osquery.conf.jinja
- so/9400_output_suricata.conf.jinja - so/9400_output_suricata.conf.jinja
- so/9500_output_beats.conf.jinja - so/9500_output_beats.conf.jinja

15
salt/logstash/pipelines/config/so/9034_output_syslog.conf.jinja
View File

@@ -3,24 +3,21 @@
{%- else %} {%- else %}
{%- set ES = salt['pillar.get']('node:mainip', '') -%} {%- set ES = salt['pillar.get']('node:mainip', '') -%}
{%- endif %} {%- endif %}
# Author: Justin Henderson
# SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics
# Updated by: Doug Burks
# Last Update: 5/15/2017
filter { filter {
if "syslog" in [tags] and "test_data" not in [tags] { if [module] =~ "syslog" {
mutate { mutate {
##add_tag => [ "conf_file_9034"] ##add_tag => [ "conf_file_9000"]
} }
} }
} }
output { output {
if "syslog" in [tags] and "test_data" not in [tags] { if [module] =~ "syslog" {
elasticsearch { elasticsearch {
pipeline => "%{module}"
hosts => "{{ ES }}" hosts => "{{ ES }}"
index => "so-syslog-%{+YYYY.MM.dd}" index => "so-syslog-%{+YYYY.MM.dd}"
template_name => "logstash" template_name => "so-common"
template => "/so-common-template.json" template => "/so-common-template.json"
template_overwrite => true template_overwrite => true
} }