CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-07 17:52:46 +01:00
Code Issues Packages Projects Releases Wiki Activity

Add ES settings to pillar

Browse Source
This commit is contained in:
Mike Reeves
2020-07-09 11:19:02 -04:00
parent 2c32c24bf0
commit 9c2f7d574d
9 changed files with 99 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
salt/logstash/pipelines/templates/so/so-beats-template.json Normal file
View File

@@ -0,0 +1,10 @@
{
"index_patterns": ["so-beats-*"],
"version":50001,
"order" : 11,
"settings":{
"number_of_replicas":0,
"number_of_shards":1,
"index.refresh_interval":"30s"
}
}

10
salt/logstash/pipelines/templates/so/so-firewall-template.json Normal file
View File

@@ -0,0 +1,10 @@
{
"index_patterns": ["so-zeek-*"],
"version":50001,
"order" : 11,
"settings":{
"number_of_replicas":0,
"number_of_shards":1,
"index.refresh_interval":"30s"
}
}

10
salt/logstash/pipelines/templates/so/so-ids-template.json Normal file
View File

@@ -0,0 +1,10 @@
{
"index_patterns": ["so-zeek-*"],
"version":50001,
"order" : 11,
"settings":{
"number_of_replicas":0,
"number_of_shards":1,
"index.refresh_interval":"30s"
}
}

10
salt/logstash/pipelines/templates/so/so-import-template.json Normal file
View File

@@ -0,0 +1,10 @@
{
"index_patterns": ["so-zeek-*"],
"version":50001,
"order" : 11,
"settings":{
"number_of_replicas":0,
"number_of_shards":1,
"index.refresh_interval":"30s"
}
}

10
salt/logstash/pipelines/templates/so/so-osquery-template.json Normal file
View File

@@ -0,0 +1,10 @@
{
"index_patterns": ["so-zeek-*"],
"version":50001,
"order" : 11,
"settings":{
"number_of_replicas":0,
"number_of_shards":1,
"index.refresh_interval":"30s"
}
}

10
salt/logstash/pipelines/templates/so/so-ossec-template.json Normal file
View File

@@ -0,0 +1,10 @@
{
"index_patterns": ["so-zeek-*"],
"version":50001,
"order" : 11,
"settings":{
"number_of_replicas":0,
"number_of_shards":1,
"index.refresh_interval":"30s"
}
}

10
salt/logstash/pipelines/templates/so/so-strelka-template.json Normal file
View File

@@ -0,0 +1,10 @@
{
"index_patterns": ["so-zeek-*"],
"version":50001,
"order" : 11,
"settings":{
"number_of_replicas":0,
"number_of_shards":1,
"index.refresh_interval":"30s"
}
}

10
salt/logstash/pipelines/templates/so/so-syslog-template.json Normal file
View File

@@ -0,0 +1,10 @@
{
"index_patterns": ["so-zeek-*"],
"version":50001,
"order" : 11,
"settings":{
"number_of_replicas":0,
"number_of_shards":1,
"index.refresh_interval":"30s"
}
}

20
setup/so-functions
View File

@@ -1068,10 +1068,28 @@ elasticsearch_pillar() {
" log_size_limit: $log_size_limit"\
" cur_close_days: $CURCLOSEDAYS"\
" route_type: hot"\
" replicas: 0"\
" true_cluster: False"
" true_cluster_name: so"
" index_settings:"\
" so-beats:"\
" shards: 1"\
" so-firewall:"\
" shards: 1"\
" so-ids:"\
" shards: 1"\
" so-import:"\
" shards: 1"\
" so-osquery:"\
" shards: 1"\
" so-ossec:"\
" shards: 1"\
" so-strelka:"\
" shards: 1"\
" so-syslog:"\
" shards: 1"\
" so-zeek:"\
" shards: 5"\
" replicas: 0"\
"" >> "$pillar_file"
if [ "$install_type" != 'EVAL' ] && [ "$install_type" != 'HELIXSENSOR' ] && [ "$install_type" != 'MASTERSEARCH' ] && [ "$install_type" != 'STANDALONE' ]; then