29 Commits
Author SHA1 Message Date
Josh Patterson f566a8965d Merge branch '3/dev' into feature/logstash-log-level 2026-08-21 11:45:00 -04:00
Josh Patterson 52fc0cb828 Expose Logstash log.level and log.format in SOC
The Logstash log level was hardcoded to info in log4j2.properties, and
logstash.yml carried no log.level key, so the only way to raise verbosity
for troubleshooting was to hand-edit a file that the next highstate
overwrites. Add log_x_level and log_x_format to logstash:config so both
render into logstash.yml, annotated as advanced per-node settings with
the value sets Logstash 9.3.7 accepts.

log4j2.properties gains jinja, so it moves to log4j2.properties.jinja and
is rendered by a discrete lslog4j2 state rather than the lsetcsync
recurse, which cannot rename. The recurse exclude_pat now matches both
names so it neither copies the template verbatim nor lets clean: True
delete the rendered file, matching how pipelines.yml is already handled.

The appender layout is selected at render time so log.format actually
changes the log output instead of being a dead setting, keeping the
existing file name so nothing downstream moves. rootLogger.level now
follows ls.log.level rather than claiming info regardless of the
configured level.
2026-08-21 09:47:09 -04:00
Josh Patterson dff3d76efd Expose Logstash 9.3.7 pipeline settings per pipeline in SOC
Add logstash:pipeline_settings carrying the 27 pipeline-scoped settings
Logstash 9.3.7 accepts, annotated individually per pipeline and rendered
into pipelines.yml. A blank setting inherits from logstash.yml. Restart
logstash when pipelines.yml changes, and add the missing managerhype
annotation.

Fixes #15090
2026-08-19 16:21:28 -04:00
reyesj2 c0f9c344bb set logstash log rollover when log size exceeds 1G
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>
2025-04-14 08:13:27 -05:00
m0duspwnens 082704ce1f logstash jinja for ui 2023-05-04 13:07:07 -04:00
m0duspwnens b14d33ced8 add logstash jinja for ui changes 2023-05-03 15:22:03 -04:00
Mike Reeves a38495ce39 Fix pillar top for firewall 2023-05-01 10:40:36 -04:00
Josh Brower b35b505f0a Fix pattern matching 2022-04-18 10:39:04 -04:00
Josh Brower 886d69fb38 Compress + Clean ES & Logstash App Logs 2022-04-11 16:09:24 -04:00
weslambert 8e2f500b9c Add config option for ECS compatibility (default of disabled) 2022-01-06 11:24:04 -05:00
Mike Reeves 09253b637e Create jvm.options 2021-12-10 14:12:43 -05:00
Mike Reeves c81ce48bff Update log4j2.properties 2021-12-10 14:10:35 -05:00
Mike Reeves 45346b6318 Update log4j2.properties 2021-12-10 12:01:39 -05:00
Mike Reeves 361b13dc88 Add a place where custom logstash certs can go 2020-10-28 15:25:00 -04:00
Mike Reeves 2c32c24bf0 Fix logstash logic 2020-07-09 09:16:48 -04:00
m0duspwnens 749935339b removing path.config 2020-04-08 15:31:11 -04:00
m0duspwnens 0c4973ad77 pillarize logstash config,parsers,templates and docker port bindings 2020-02-25 17:44:32 -05:00
m0duspwnens 7604853c59 fix logic for logstash pipelines 2020-02-19 16:02:24 -05:00
Wes Lambert 8d9ff4428b Update Strelka LS config 2020-02-17 21:12:25 +00:00
m0duspwnens 799cf32265 fix logstash for so-helix role 2020-02-05 14:45:07 -05:00
m0duspwnens d94065fa00 evalfix 2020-01-30 17:09:06 -05:00
m0duspwnens bd5b597aed heavynode 2020-01-29 12:56:25 -05:00
m0duspwnens 306cc1127b heavynode 2020-01-29 12:56:25 -05:00
m0duspwnens a39edad3f6 changes for multipipelines / mastersearch node - https://github.com/Security-Onion-Solutions/securityonion-saltstack/issues/124 2020-01-21 16:39:42 -05:00
Dustin Lee 699371a4d7 logstash: add beats template used in latest SO 2019-10-11 08:36:44 -04:00
Josh Brower 9a4eadc967 Add rule_signature mapping 2019-09-19 08:30:33 -04:00
Mike Reeves 05a4c6410f LogStash and Kibana modules - Clean up for new Zeek Version 2019-01-15 10:51:30 -05:00
Wes Lambert 056e22dd11 Logstash - Update template for Suricata metadata fields 2018-11-30 13:22:31 +00:00
Mike Reeves 4203898427 Logstash Module - Rework it 2018-11-28 20:44:56 -05:00