Elastic Fleet Certs Refactor

salt/logstash/enabled.sls

@@ -59,8 +59,10 @@ so-logstash:
       - /etc/pki/filebeat.p8:/usr/share/logstash/filebeat.key:ro
       {% endif %}
       {% if GLOBALS.role in ['so-manager', 'so-managersearch', 'so-standalone', 'so-import', 'so-eval','so-fleet', 'so-heavynode', 'so-receiver'] %}
-      - /opt/so/conf/elastic-fleet/certs/elasticfleet-logstash.crt:/usr/share/logstash/elasticfleet-logstash.crt:ro
-      - /opt/so/conf/elastic-fleet/certs/elasticfleet-logstash.p8:/usr/share/logstash/elasticfleet-logstash.key:ro
+      - /etc/pki/elasticfleet-logstash.crt:/usr/share/logstash/elasticfleet-logstash.crt:ro
+      - /etc/pki/elasticfleet-logstash.p8:/usr/share/logstash/elasticfleet-logstash.key:ro
+      - /etc/pki/elasticfleet-lumberjack.crt:/usr/share/logstash/elasticfleet-lumberjack.crt:ro
+      - /etc/pki/elasticfleet-lumberjack.p8:/usr/share/logstash/elasticfleet-lumberjack.key:ro
       {% endif %}
       {% if GLOBALS.role in ['so-manager', 'so-managersearch', 'so-standalone', 'so-import'] %}
       - /etc/pki/ca.crt:/usr/share/filebeat/ca.crt:ro

salt/logstash/pipelines/config/so/0013_input_http_fleet.conf

@@ -1,21 +1,18 @@
 input {
-  http {
-    additional_codecs => { "application/json" => "json_lines" }
+  elastic_agent {
     port => 5056
     tags => [ "elastic-agent" ]
     ssl => true
-    ssl_certificate_authorities => ["/usr/share/filebeat/ca.crt"]
-    ssl_certificate => "/usr/share/logstash/filebeat.crt"
-    ssl_key => "/usr/share/logstash/filebeat.key"
-    ssl_verify_mode => "peer"
+    ssl_certificate => "/usr/share/logstash/elasticfleet-lumberjack.crt"
+    ssl_key => "/usr/share/logstash/elasticfleet-lumberjack.key"
     ecs_compatibility => v8
+    id => "fleet-lumberjack-in"  
+    codec => "json"
+  }
+}
+filter {
+  mutate {
+    rename => {"@metadata" => "metadata"}
   }
 }
 
-filter {
-   if "elastic-agent" in [tags] {
-  mutate {
-    remove_field => ["http","[metadata][input]","url","user_agent"]
-}
-   }
-}

salt/logstash/pipelines/config/so/9806_output_http_fleet.conf.jinja

@@ -1,11 +1,15 @@
-output {
-  http {
-    url => 'https://{{ GLOBALS.manager }}:5056'
-    cacert => ["/usr/share/filebeat/ca.crt"]
-    http_method => post
-    retry_non_idempotent => true
-    format => json_batch
-    http_compression => true
-    ecs_compatibility => v8
+filter {
+       mutate {
+                    add_tag => "fleet-lumberjack-{{ GLOBALS.hostname }}"
+          }
   }
-}
+
+output { 
+    lumberjack { 
+        codec => json 
+        hosts => "{{ GLOBALS.manager }}"
+        ssl_certificate => "/usr/share/filebeat/ca.crt"
+        port => 5056 
+        id => "fleet-lumberjack-{{ GLOBALS.hostname }}"
+        } 
+    }