CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2026-01-28 10:53:34 +01:00
Code Issues Packages Projects Releases Wiki Activity

disable logstash metrics collection on nodes not running logstash + fleet nodes

Browse Source
This commit is contained in:
reyesj2
2026-01-27 16:37:23 -06:00
parent ff4ec69f7c
commit e5226b50ed
1 changed files with 3 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
salt/telegraf/etc/telegraf.conf
View File

@@ -7,6 +7,7 @@
{%- set UNIQUEID = salt['pillar.get']('sensor:uniqueid', '') %}
{%- set ZEEK_ENABLED = salt['pillar.get']('zeek:enabled', True) %}
{%- set MDENGINE = GLOBALS.md_engine %}
{%- set LOGSTASH_ENABLED = salt['pillar.get']('logstash:enabled', False) %}
# Global tags can be specified here in key="value" format.
[global_tags]
role = "{{ GLOBALS.role.split('-') | last }}"
@@ -241,12 +242,8 @@
# ## Use TLS but skip chain & host verification
# # insecure_skip_verify = false
{%- set logstash_metrics_roles = ['so-searchnode','so-standalone','so-managersearch','so-heavynode'] %}
{%- if GLOBALS.pipeline != "KAFKA" %}
{%- set logstash_metrics_roles = logstash_metrics_roles + ['so-manager', 'so-receiver'] %}
{%- endif %}
{%- if grains.role in logstash_metrics_roles %}
{#- Fleet nodes do not have pillar access to logstash credentials #}
{%- if LOGSTASH_ENABLED and grains.role != 'so-fleet' %}
[[inputs.logstash]]
url = "http://localhost:9600"
collect = ["pipelines"]