CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 09:12:45 +01:00
Code Issues Packages Projects Releases Wiki Activity

Add logstash_settings pillar

Browse Source
This commit is contained in:
Mike Reeves
2020-07-01 15:25:35 -04:00
parent 5580f05daf
commit ab42126d8e
5 changed files with 13 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
salt/logstash/init.sls
View File

@@ -23,19 +23,12 @@
{% endif %} {% endif %}
# Logstash Section - Decide which pillar to use # Logstash Section - Decide which pillar to use
{% if grains['role'] == 'so-sensor' %} {% set lsheap = salt['pillar.get']('logstash_settings:lsheap', '') %}
{% set lsheap = salt['pillar.get']('sensor:lsheap', '') %}
{% set lsaccessip = salt['pillar.get']('sensor:lsaccessip', '') %}
{% elif grains['role'] == 'so-node' or grains['role'] == 'so-heavynode' %}
{% set lsheap = salt['pillar.get']('node:lsheap', '') %}
{% set nodetype = salt['pillar.get']('node:node_type', 'storage') %}
{% elif grains['role'] in ['so-eval','so-mastersearch', 'so-master', 'so-standalone'] %} {% elif grains['role'] in ['so-eval','so-mastersearch', 'so-master', 'so-standalone'] %}
{% set lsheap = salt['pillar.get']('master:lsheap', '') %}
{% set freq = salt['pillar.get']('master:freq', '0') %} {% set freq = salt['pillar.get']('master:freq', '0') %}
{% set dstats = salt['pillar.get']('master:domainstats', '0') %} {% set dstats = salt['pillar.get']('master:domainstats', '0') %}
{% set nodetype = salt['grains.get']('role', '') %} {% set nodetype = salt['grains.get']('role', '') %}
{% elif grains['role'] == 'so-helix' %} {% elif grains['role'] == 'so-helix' %}
{% set lsheap = salt['pillar.get']('master:lsheap', '') %}
{% set freq = salt['pillar.get']('master:freq', '0') %} {% set freq = salt['pillar.get']('master:freq', '0') %}
{% set dstats = salt['pillar.get']('master:domainstats', '0') %} {% set dstats = salt['pillar.get']('master:domainstats', '0') %}
{% set nodetype = salt['grains.get']('role', '') %} {% set nodetype = salt['grains.get']('role', '') %}

10
salt/logstash/pipelines/config/so/0900_input_redis.conf.jinja
View File

@@ -1,14 +1,16 @@
{%- if grains.role == 'so-heavynode' %} {%- if grains.role == 'so-heavynode' %}
{%- set master = salt['pillar.get']('node:mainip', '') %} {%- set MASTER = salt['pillar.get']('node:mainip', '') %}
{%- else %} {%- else %}
{%- set master = salt['pillar.get']('static:masterip', '') %} {%- set MASTER = salt['pillar.get']('static:masterip', '') %}
{% endif -%} {% endif -%}
{%- set THREADS = salt['pillar.get']('logstash_settings:ls_input_threads', '') %}
input { input {
redis { redis {
host => '{{ master }}' host => '{{ MASTER }}'
data_type => 'list' data_type => 'list'
key => 'logstash:unparsed' key => 'logstash:unparsed'
type => 'redis-input' type => 'redis-input'
# threads => 1 threads => {{ THREADS }}
} }
} }

2
salt/logstash/pipelines/config/so/9999_output_redis.conf.jinja
View File

@@ -1,5 +1,5 @@
{% set MASTER = salt['pillar.get']('static:masterip', '') %} {% set MASTER = salt['pillar.get']('static:masterip', '') %}
{% set BATCH = salt['pillar.get']('logstash:batch_size', 125) %} {% set BATCH = salt['pillar.get']('logstash_settings:ls_pipeline_batch_size', 125) %}
output { output {
redis { redis {

1
salt/redis/init.sls
View File

@@ -12,7 +12,6 @@
# #
# You should have received a copy of the GNU General Public License # You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>. # along with this program. If not, see <http://www.gnu.org/licenses/>.
{% set lsaccessip = salt['pillar.get']('master:lsaccessip', '') %}
{% set VERSION = salt['pillar.get']('static:soversion', 'HH1.2.2') %} {% set VERSION = salt['pillar.get']('static:soversion', 'HH1.2.2') %}
{% set MASTER = salt['grains.get']('master') %} {% set MASTER = salt['grains.get']('master') %}

13
setup/so-functions
View File

@@ -894,10 +894,7 @@ master_pillar() {
esac esac
printf '%s\n'\ printf '%s\n'\
" lsheap: $LS_HEAP_SIZE"\
" lsaccessip: 127.0.0.1"\
" elastalert: 1"\ " elastalert: 1"\
" ls_pipeline_workers: $num_cpu_cores"\
" nids_rules: $RULESETUP"\ " nids_rules: $RULESETUP"\
" oinkcode: $OINKCODE"\ " oinkcode: $OINKCODE"\
" es_port: $node_es_port"\ " es_port: $node_es_port"\
@@ -909,10 +906,12 @@ master_pillar() {
" playbook: $PLAYBOOK"\ " playbook: $PLAYBOOK"\
" url_base: $REDIRECTIT"\ " url_base: $REDIRECTIT"\
""\ ""\
"logstash:"\ "logstash_settings:"\
" ls_pipeline_batch_size: 125"\ " ls_pipeline_batch_size: 125"\
" ls_input_threads: 1"\ " ls_input_threads: 1"\
" ls_batch_count: 125"\ " ls_batch_count: 125"\
" lsheap: $LS_HEAP_SIZE"\
" ls_pipeline_workers: $num_cpu_cores"\
""\ ""\
"kratos:" >> "$pillar_file" "kratos:" >> "$pillar_file"
@@ -1009,18 +1008,16 @@ node_pillar() {
" mainint: $MNIC"\ " mainint: $MNIC"\
" esheap: $NODE_ES_HEAP_SIZE"\ " esheap: $NODE_ES_HEAP_SIZE"\
" esclustername: {{ grains.host }}"\ " esclustername: {{ grains.host }}"\
" lsheap: $NODE_LS_HEAP_SIZE"\
" ls_input_threads: $LSINPUTTHREADS"\
" ls_batch_count: $LSINPUTBATCHCOUNT"\
" es_shard_count: $SHARDCOUNT"\ " es_shard_count: $SHARDCOUNT"\
" node_type: $NODETYPE"\ " node_type: $NODETYPE"\
" es_port: $node_es_port"\ " es_port: $node_es_port"\
" log_size_limit: $log_size_limit"\ " log_size_limit: $log_size_limit"\
" cur_close_days: $CURCLOSEDAYS"\ " cur_close_days: $CURCLOSEDAYS"\
"logstash:"\ "logstash_settings:"\
" ls_pipeline_batch_size: $LSPIPELINEBATCH"\ " ls_pipeline_batch_size: $LSPIPELINEBATCH"\
" ls_input_threads: $LSINPUTTHREADS"\ " ls_input_threads: $LSINPUTTHREADS"\
" ls_batch_count: $LSINPUTBATCHCOUNT"\ " ls_batch_count: $LSINPUTBATCHCOUNT"\
" lsheap: $NODE_LS_HEAP_SIZE"\
"" >> "$pillar_file" "" >> "$pillar_file"
printf '%s\n' '----' >> "$setup_log" 2>&1 printf '%s\n' '----' >> "$setup_log" 2>&1