Merge branch 'dev' into kilo

salt/logstash/pipelines/config/so/0009_input_beats.conf

@@ -3,4 +3,9 @@ input {
     port => "5044"
     tags => [ "beat-ext" ]
   }
+}
+filter {
+  mutate {
+    rename => {"@metadata" => "metadata"}
+  }
 }

salt/logstash/pipelines/config/so/9050_output_filebeatmodules.conf.jinja

@@ -0,0 +1,20 @@
+{%- if grains['role'] == 'so-eval' -%}
+{%- set ES = salt['pillar.get']('manager:mainip', '') -%}
+{%- else %}
+{%- set ES = salt['pillar.get']('elasticsearch:mainip', '') -%}
+{%- endif %}
+output {
+ if [metadata][pipeline] {
+   elasticsearch {
+     id => "filebeat_modules_metadata_pipeline"
+     pipeline => "%{[metadata][pipeline]}"
+     hosts => "{{ ES }}"
+     index => "so-%{[event][module]}-%{+YYYY.MM.dd}"
+     template_name => "so-common"
+     template => "/templates/so-common-template.json"
+     template_overwrite => true
+     ssl => true
+     ssl_certificate_verification => false
+   }
+ }
+}

salt/logstash/pipelines/config/so/9400_output_suricata.conf.jinja

@@ -19,4 +19,4 @@ output {
       ssl_certificate_verification => false
     }
   }
-}
+}