CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 17:22:49 +01:00
Code Issues Packages Projects Releases Wiki Activity

Check if Filebeat modules are being used for incoming Beats

Browse Source
This commit is contained in:
weslambert
2021-07-19 12:57:42 -04:00
committed by GitHub
parent bab18275bc
commit fea4f3f973
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
salt/logstash/pipelines/config/so/9500_output_beats.conf.jinja
View File

@@ -6,7 +6,7 @@
{%- set ES_USER = salt['pillar.get']('elasticsearch:auth:users:so_elastic_user:user', '') %} {%- set ES_USER = salt['pillar.get']('elasticsearch:auth:users:so_elastic_user:user', '') %}
{%- set ES_PASS = salt['pillar.get']('elasticsearch:auth:users:so_elastic_user:pass', '') %} {%- set ES_PASS = salt['pillar.get']('elasticsearch:auth:users:so_elastic_user:pass', '') %}
output { output {
if "beat-ext" in [tags] and "import" not in [tags] { if "beat-ext" in [tags] and "import" not in [tags] and "filebeat" not in [metadata][pipeline] {
elasticsearch { elasticsearch {
pipeline => "beats.common" pipeline => "beats.common"
hosts => "{{ ES }}" hosts => "{{ ES }}"