CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 17:22:49 +01:00
Code Issues Packages Projects Releases Wiki Activity

Filebeat - Update for Wazuh logs

Browse Source
This commit is contained in:
Wes Lambert
2018-12-07 13:38:31 +00:00
parent e11aadf730
commit e355503324
1 changed files with 11 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
salt/filebeat/etc/filebeat.yml
View File

@@ -36,6 +36,16 @@ filebeat.prospectors:
clean_removed: false clean_removed: false
close_removed: false close_removed: false
- type: log
paths:
- /alerts/alerts.json
fields:
type: ossec
fields_under_root: true
clean_removed: false
close_removed: false
#----------------------------- Logstash output --------------------------------- #----------------------------- Logstash output ---------------------------------
output.logstash: output.logstash:
@@ -152,7 +162,7 @@ output.logstash:
# Sets log level. The default log level is info. # Sets log level. The default log level is info.
# Available log levels are: error, warning, info, debug # Available log levels are: error, warning, info, debug
#logging.level: info logging.level: debug
# Enable debug output for selected components. To enable all selectors use ["*"] # Enable debug output for selected components. To enable all selectors use ["*"]
# Other available selectors are "beat", "publish", "service" # Other available selectors are "beat", "publish", "service"