From bc7bf5774a12491d85c20ae4db54a3234b3781c8 Mon Sep 17 00:00:00 2001
From: Josh Brower <josh@defensivedepth.com>
Date: Tue, 1 Jan 2019 11:14:38 -0500
Subject: [PATCH] Enable osquery parsers for EVAL role

---
 salt/logstash/conf/conf.enabled.txt.so-eval | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/salt/logstash/conf/conf.enabled.txt.so-eval b/salt/logstash/conf/conf.enabled.txt.so-eval
index 71e50525f..5c85ab8ac 100644
--- a/salt/logstash/conf/conf.enabled.txt.so-eval
+++ b/salt/logstash/conf/conf.enabled.txt.so-eval
@@ -107,3 +107,5 @@
 /usr/share/logstash/pipeline.dynamic/9500_output_beats.conf
 /usr/share/logstash/pipeline.dynamic/9600_output_ossec.conf
 /usr/share/logstash/pipeline.dynamic/9998_output_test_data.conf
+/usr/share/logstash/pipeline.dynamic/7100_osquery_wel.conf
+/usr/share/logstash/pipeline.dynamic/9100_output_osquery.conf