CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-08 10:12:53 +01:00
Code Issues Packages Projects Releases Wiki Activity

Logstash Module - Change it to arrays

Browse Source
This commit is contained in:
Mike Reeves
2018-10-16 17:41:04 -04:00
parent 335ac02720
commit ea7ddfc2da
1 changed files with 7 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
salt/logstash/files/dynamic/0006_input_beats.conf
View File

@@ -11,18 +11,18 @@ input {
filter { filter {
if "ids" in [tags] { if "ids" in [tags] {
mutate { mutate {
rename => { "[beat][name]", "sensor_name" }
rename => { "[beat][hostname]", "syslog-host_from" }
remove_tag => ["beat"]
rename => { "host" => "beat_host" } rename => { "host" => "beat_host" }
remove_tag => ["beat"]
copy => {"%{beat[name]}" => "sensor_name"}
copy => {"%{beat[name]}" => "syslog-host_from"}
} }
} }
if "bro" in [tags] { if "bro" in [tags] {
mutate { mutate {
rename => { "[beat][name]", "sensor_name" } rename => { "host" => "beat_host" }
rename => { "[beat][hostname]", "syslog-host_from" } remove_tag => ["beat"]
remove_tag => ["beat"] copy => {"%{beat[name]}" => "sensor_name"}
rename => { "host" => "beat_host" } copy => {"%{beat[name]}" => "syslog-host_from"}
} }
} }
} }