logstash:
  pipelines:
    search:
      config:
        - so/1000_preprocess_log_elapsed.conf
        - so/1001_preprocess_syslogng.conf
        - so/1002_preprocess_json.conf
        - so/1004_preprocess_syslog_types.conf
        - so/1026_preprocess_dhcp.conf
        - so/1029_preprocess_esxi.conf
        - so/1030_preprocess_greensql.conf
        - so/1031_preprocess_iis.conf
        - so/1032_preprocess_mcafee.conf
        - so/1033_preprocess_snort.conf
        - so/1034_preprocess_syslog.conf
        - so/2000_network_flow.conf
        - so/6002_syslog.conf
        - so/6101_switch_brocade.conf
        - so/6200_firewall_fortinet.conf
        - so/6201_firewall_pfsense.conf
        - so/6300_windows.conf
        - so/6301_dns_windows.conf
        - so/6400_suricata.conf
        - so/6500_ossec.conf
        - so/6501_ossec_sysmon.conf
        - so/6502_ossec_autoruns.conf
        - so/6600_winlogbeat_sysmon.conf
        - so/6700_winlogbeat.conf
        - so/7100_osquery_wel.conf
        - so/7200_strelka.conf
        - so/8001_postprocess_common_ip_augmentation.conf
        - so/8007_postprocess_http.conf
        - so/8200_postprocess_tagging.conf
        - so/8998_postprocess_log_elapsed.conf
        - so/8999_postprocess_rename_type.conf
        - so/0900_input_redis.conf.jinja
        - so/9000_output_bro.conf.jinja
        - so/9001_output_switch.conf.jinja
        - so/9002_output_import.conf.jinja
        - so/9004_output_flow.conf.jinja
        - so/9026_output_dhcp.conf.jinja
        - so/9029_output_esxi.conf.jinja
        - so/9030_output_greensql.conf.jinja
        - so/9031_output_iis.conf.jinja
        - so/9032_output_mcafee.conf.jinja
        - so/9033_output_snort.conf.jinja
        - so/9034_output_syslog.conf.jinja
        - so/9100_output_osquery.conf.jinja
        - so/9200_output_firewall.conf.jinja
        - so/9300_output_windows.conf.jinja
        - so/9301_output_dns_windows.conf.jinja
        - so/9400_output_suricata.conf.jinja
        - so/9500_output_beats.conf.jinja
        - so/9600_output_ossec.conf.jinja
        - so/9700_output_strelka.conf.jinja
  templates:
    - so/beats-template.json
    - so/logstash-ossec-template.json
    - so/logstash-strelka-template.json
    - so/logstash-template.json