From a57f44a022788abbbe53d9f73467dc60ce63e970 Mon Sep 17 00:00:00 2001
From: Mike Reeves <mike.reeves@securityonionsolutions.com>
Date: Thu, 19 Apr 2018 13:30:31 -0400
Subject: [PATCH] Logstash Module - Add redis output

---
 .../{conf.enabled.txt => conf.enabled.txt.eval} |  2 +-
 salt/logstash/files/conf.enabled.txt.master     | 17 +++++++++++++++++
 .../files/dynamic/9999_output_redis.conf        | 10 ++++++++++
 salt/logstash/init.sls                          |  1 +
 4 files changed, 29 insertions(+), 1 deletion(-)
 rename salt/logstash/files/{conf.enabled.txt => conf.enabled.txt.eval} (99%)
 create mode 100644 salt/logstash/files/conf.enabled.txt.master
 create mode 100644 salt/logstash/files/dynamic/9999_output_redis.conf

diff --git a/salt/logstash/files/conf.enabled.txt b/salt/logstash/files/conf.enabled.txt.eval
similarity index 99%
rename from salt/logstash/files/conf.enabled.txt
rename to salt/logstash/files/conf.enabled.txt.eval
index 282d125d3..404005b12 100644
--- a/salt/logstash/files/conf.enabled.txt
+++ b/salt/logstash/files/conf.enabled.txt.eval
@@ -5,7 +5,7 @@
 #
 # To enable a custom configuration see the following example and uncomment:
 # /usr/share/logstash/pipeline.custom/1234_input_custom.conf
-#
+##
 # All of the defaults are loaded.
 /usr/share/logstash/pipeline.so/0000_input_syslogng.conf
 /usr/share/logstash/pipeline.so/0001_input_json.conf
diff --git a/salt/logstash/files/conf.enabled.txt.master b/salt/logstash/files/conf.enabled.txt.master
new file mode 100644
index 000000000..a4da29cad
--- /dev/null
+++ b/salt/logstash/files/conf.enabled.txt.master
@@ -0,0 +1,17 @@
+# This is where can specify which LogStash configs get loaded.
+#
+# The custom folder on the master gets automatically synced to each logstash
+# node.
+#
+# To enable a custom configuration see the following example and uncomment:
+# /usr/share/logstash/pipeline.custom/1234_input_custom.conf
+##
+# All of the defaults are loaded.
+/usr/share/logstash/pipeline.so/0000_input_syslogng.conf
+/usr/share/logstash/pipeline.so/0001_input_json.conf
+/usr/share/logstash/pipeline.so/0002_input_windows_json.conf
+/usr/share/logstash/pipeline.so/0003_input_syslog.conf
+/usr/share/logstash/pipeline.so/0005_input_suricata.conf
+/usr/share/logstash/pipeline.so/0006_input_beats.conf
+/usr/share/logstash/pipeline.so/0007_input_import.conf
+/usr/share/logstash/pipeline.dynamic/9999_output_redis.conf
diff --git a/salt/logstash/files/dynamic/9999_output_redis.conf b/salt/logstash/files/dynamic/9999_output_redis.conf
new file mode 100644
index 000000000..81332c94d
--- /dev/null
+++ b/salt/logstash/files/dynamic/9999_output_redis.conf
@@ -0,0 +1,10 @@
+output {
+	redis {
+		host => 'redis'
+		data_type => 'list'
+		key => 'logstash:redis'
+		congestion_interval => 1
+		congestion_threshold => 50000000
+		# batch_events => 500
+	}
+}
diff --git a/salt/logstash/init.sls b/salt/logstash/init.sls
index 68a53de8e..8cb580fab 100644
--- a/salt/logstash/init.sls
+++ b/salt/logstash/init.sls
@@ -106,6 +106,7 @@ so-logstash:
       - /opt/so/conf/logstash/beats-template.json:/beats-template.json:ro
       - /opt/so/conf/logstash/custom:/usr/share/logstash/pipeline.custom:ro
       - /opt/so/conf/logstash/rulesets:/usr/share/logstash/rulesets:ro
+      - /opt/so/conf/logstash/dynamic:/usr/share/logstash/pipeline.dynamic
       - /opt/so/conf/logstash/conf.enabled.txt:/usr/share/logstash/conf.enabled.txt:ro
       - /opt/so/rules:/etc/nsm/rules:ro
       - /nsm/import:/nsm/import:ro