logstash:
  enabled: False
  assigned_pipelines:
    roles:
      standalone:
        - manager
        - search
      receiver:
        - receiver
      heavynode: []
      searchnode:
        - search
      manager:
        - manager
      managerhype:
        - manager
      managersearch:
        - manager
        - search
      fleet:
        - fleet
  defined_pipelines:
    fleet:
      - so/0012_input_elastic_agent.conf.jinja
      - so/9806_output_lumberjack_fleet.conf.jinja
    manager:
      - so/0011_input_endgame.conf
      - so/0012_input_elastic_agent.conf.jinja
      - so/0013_input_lumberjack_fleet.conf.jinja
      - so/9999_output_redis.conf.jinja
    receiver:
      - so/0011_input_endgame.conf
      - so/0012_input_elastic_agent.conf.jinja
      - so/0013_input_lumberjack_fleet.conf.jinja
      - so/9999_output_redis.conf.jinja
    search:
      - so/0900_input_redis.conf.jinja
      - so/9805_output_elastic_agent.conf.jinja
      - so/9900_output_endgame.conf.jinja
    custom0: []
    custom1: []
    custom2: []
    custom3: []
    custom4: []
    custom5: []
    custom6: []
    custom7: []
    custom8: []
    custom9: []
  pipeline_config:
    custom001: |-
      filter {
        if [event][module] =~ "zeek" {
          mutate {
            add_tag => ["network_stuff"]
          }
        }
      }
    custom002: PLACEHOLDER
    custom003: PLACEHOLDER
    custom004: PLACEHOLDER
    custom005: PLACEHOLDER
    custom006: PLACEHOLDER
    custom007: PLACEHOLDER
    custom008: PLACEHOLDER
    custom009: PLACEHOLDER
    custom010: PLACEHOLDER
  pipeline_settings:
    fleet:
      pipeline_x_workers: ''
      pipeline_x_batch_x_size: ''
      pipeline_x_batch_x_delay: ''
      pipeline_x_batch_x_metrics_x_sampling_mode: ''
      pipeline_x_ordered: ''
      pipeline_x_ecs_compatibility: ''
      pipeline_x_reloadable: ''
      queue_x_type: ''
      queue_x_max_bytes: ''
      queue_x_page_capacity: ''
      queue_x_max_events: ''
      queue_x_checkpoint_x_acks: ''
      queue_x_checkpoint_x_writes: ''
      queue_x_checkpoint_x_interval: ''
      queue_x_checkpoint_x_retry: ''
      queue_x_compression: ''
      queue_x_drain: ''
      dead_letter_queue_x_enable: ''
      dead_letter_queue_x_max_bytes: ''
      dead_letter_queue_x_flush_interval: ''
      dead_letter_queue_x_flush_check_interval: ''
      dead_letter_queue_x_storage_policy: ''
      dead_letter_queue_x_retain_x_age: ''
      path_x_queue: ''
      path_x_dead_letter_queue: ''
      config_x_debug: ''
      config_x_support_escapes: ''
    manager:
      pipeline_x_workers: ''
      pipeline_x_batch_x_size: ''
      pipeline_x_batch_x_delay: ''
      pipeline_x_batch_x_metrics_x_sampling_mode: ''
      pipeline_x_ordered: ''
      pipeline_x_ecs_compatibility: ''
      pipeline_x_reloadable: ''
      queue_x_type: ''
      queue_x_max_bytes: ''
      queue_x_page_capacity: ''
      queue_x_max_events: ''
      queue_x_checkpoint_x_acks: ''
      queue_x_checkpoint_x_writes: ''
      queue_x_checkpoint_x_interval: ''
      queue_x_checkpoint_x_retry: ''
      queue_x_compression: ''
      queue_x_drain: ''
      dead_letter_queue_x_enable: ''
      dead_letter_queue_x_max_bytes: ''
      dead_letter_queue_x_flush_interval: ''
      dead_letter_queue_x_flush_check_interval: ''
      dead_letter_queue_x_storage_policy: ''
      dead_letter_queue_x_retain_x_age: ''
      path_x_queue: ''
      path_x_dead_letter_queue: ''
      config_x_debug: ''
      config_x_support_escapes: ''
    receiver:
      pipeline_x_workers: ''
      pipeline_x_batch_x_size: ''
      pipeline_x_batch_x_delay: ''
      pipeline_x_batch_x_metrics_x_sampling_mode: ''
      pipeline_x_ordered: ''
      pipeline_x_ecs_compatibility: ''
      pipeline_x_reloadable: ''
      queue_x_type: ''
      queue_x_max_bytes: ''
      queue_x_page_capacity: ''
      queue_x_max_events: ''
      queue_x_checkpoint_x_acks: ''
      queue_x_checkpoint_x_writes: ''
      queue_x_checkpoint_x_interval: ''
      queue_x_checkpoint_x_retry: ''
      queue_x_compression: ''
      queue_x_drain: ''
      dead_letter_queue_x_enable: ''
      dead_letter_queue_x_max_bytes: ''
      dead_letter_queue_x_flush_interval: ''
      dead_letter_queue_x_flush_check_interval: ''
      dead_letter_queue_x_storage_policy: ''
      dead_letter_queue_x_retain_x_age: ''
      path_x_queue: ''
      path_x_dead_letter_queue: ''
      config_x_debug: ''
      config_x_support_escapes: ''
    search:
      pipeline_x_workers: ''
      pipeline_x_batch_x_size: ''
      pipeline_x_batch_x_delay: ''
      pipeline_x_batch_x_metrics_x_sampling_mode: ''
      pipeline_x_ordered: ''
      pipeline_x_ecs_compatibility: ''
      pipeline_x_reloadable: ''
      queue_x_type: ''
      queue_x_max_bytes: ''
      queue_x_page_capacity: ''
      queue_x_max_events: ''
      queue_x_checkpoint_x_acks: ''
      queue_x_checkpoint_x_writes: ''
      queue_x_checkpoint_x_interval: ''
      queue_x_checkpoint_x_retry: ''
      queue_x_compression: ''
      queue_x_drain: ''
      dead_letter_queue_x_enable: ''
      dead_letter_queue_x_max_bytes: ''
      dead_letter_queue_x_flush_interval: ''
      dead_letter_queue_x_flush_check_interval: ''
      dead_letter_queue_x_storage_policy: ''
      dead_letter_queue_x_retain_x_age: ''
      path_x_queue: ''
      path_x_dead_letter_queue: ''
      config_x_debug: ''
      config_x_support_escapes: ''
    custom0:
      pipeline_x_workers: ''
      pipeline_x_batch_x_size: ''
      pipeline_x_batch_x_delay: ''
      pipeline_x_batch_x_metrics_x_sampling_mode: ''
      pipeline_x_ordered: ''
      pipeline_x_ecs_compatibility: ''
      pipeline_x_reloadable: ''
      queue_x_type: ''
      queue_x_max_bytes: ''
      queue_x_page_capacity: ''
      queue_x_max_events: ''
      queue_x_checkpoint_x_acks: ''
      queue_x_checkpoint_x_writes: ''
      queue_x_checkpoint_x_interval: ''
      queue_x_checkpoint_x_retry: ''
      queue_x_compression: ''
      queue_x_drain: ''
      dead_letter_queue_x_enable: ''
      dead_letter_queue_x_max_bytes: ''
      dead_letter_queue_x_flush_interval: ''
      dead_letter_queue_x_flush_check_interval: ''
      dead_letter_queue_x_storage_policy: ''
      dead_letter_queue_x_retain_x_age: ''
      path_x_queue: ''
      path_x_dead_letter_queue: ''
      config_x_debug: ''
      config_x_support_escapes: ''
    custom1:
      pipeline_x_workers: ''
      pipeline_x_batch_x_size: ''
      pipeline_x_batch_x_delay: ''
      pipeline_x_batch_x_metrics_x_sampling_mode: ''
      pipeline_x_ordered: ''
      pipeline_x_ecs_compatibility: ''
      pipeline_x_reloadable: ''
      queue_x_type: ''
      queue_x_max_bytes: ''
      queue_x_page_capacity: ''
      queue_x_max_events: ''
      queue_x_checkpoint_x_acks: ''
      queue_x_checkpoint_x_writes: ''
      queue_x_checkpoint_x_interval: ''
      queue_x_checkpoint_x_retry: ''
      queue_x_compression: ''
      queue_x_drain: ''
      dead_letter_queue_x_enable: ''
      dead_letter_queue_x_max_bytes: ''
      dead_letter_queue_x_flush_interval: ''
      dead_letter_queue_x_flush_check_interval: ''
      dead_letter_queue_x_storage_policy: ''
      dead_letter_queue_x_retain_x_age: ''
      path_x_queue: ''
      path_x_dead_letter_queue: ''
      config_x_debug: ''
      config_x_support_escapes: ''
    custom2:
      pipeline_x_workers: ''
      pipeline_x_batch_x_size: ''
      pipeline_x_batch_x_delay: ''
      pipeline_x_batch_x_metrics_x_sampling_mode: ''
      pipeline_x_ordered: ''
      pipeline_x_ecs_compatibility: ''
      pipeline_x_reloadable: ''
      queue_x_type: ''
      queue_x_max_bytes: ''
      queue_x_page_capacity: ''
      queue_x_max_events: ''
      queue_x_checkpoint_x_acks: ''
      queue_x_checkpoint_x_writes: ''
      queue_x_checkpoint_x_interval: ''
      queue_x_checkpoint_x_retry: ''
      queue_x_compression: ''
      queue_x_drain: ''
      dead_letter_queue_x_enable: ''
      dead_letter_queue_x_max_bytes: ''
      dead_letter_queue_x_flush_interval: ''
      dead_letter_queue_x_flush_check_interval: ''
      dead_letter_queue_x_storage_policy: ''
      dead_letter_queue_x_retain_x_age: ''
      path_x_queue: ''
      path_x_dead_letter_queue: ''
      config_x_debug: ''
      config_x_support_escapes: ''
    custom3:
      pipeline_x_workers: ''
      pipeline_x_batch_x_size: ''
      pipeline_x_batch_x_delay: ''
      pipeline_x_batch_x_metrics_x_sampling_mode: ''
      pipeline_x_ordered: ''
      pipeline_x_ecs_compatibility: ''
      pipeline_x_reloadable: ''
      queue_x_type: ''
      queue_x_max_bytes: ''
      queue_x_page_capacity: ''
      queue_x_max_events: ''
      queue_x_checkpoint_x_acks: ''
      queue_x_checkpoint_x_writes: ''
      queue_x_checkpoint_x_interval: ''
      queue_x_checkpoint_x_retry: ''
      queue_x_compression: ''
      queue_x_drain: ''
      dead_letter_queue_x_enable: ''
      dead_letter_queue_x_max_bytes: ''
      dead_letter_queue_x_flush_interval: ''
      dead_letter_queue_x_flush_check_interval: ''
      dead_letter_queue_x_storage_policy: ''
      dead_letter_queue_x_retain_x_age: ''
      path_x_queue: ''
      path_x_dead_letter_queue: ''
      config_x_debug: ''
      config_x_support_escapes: ''
    custom4:
      pipeline_x_workers: ''
      pipeline_x_batch_x_size: ''
      pipeline_x_batch_x_delay: ''
      pipeline_x_batch_x_metrics_x_sampling_mode: ''
      pipeline_x_ordered: ''
      pipeline_x_ecs_compatibility: ''
      pipeline_x_reloadable: ''
      queue_x_type: ''
      queue_x_max_bytes: ''
      queue_x_page_capacity: ''
      queue_x_max_events: ''
      queue_x_checkpoint_x_acks: ''
      queue_x_checkpoint_x_writes: ''
      queue_x_checkpoint_x_interval: ''
      queue_x_checkpoint_x_retry: ''
      queue_x_compression: ''
      queue_x_drain: ''
      dead_letter_queue_x_enable: ''
      dead_letter_queue_x_max_bytes: ''
      dead_letter_queue_x_flush_interval: ''
      dead_letter_queue_x_flush_check_interval: ''
      dead_letter_queue_x_storage_policy: ''
      dead_letter_queue_x_retain_x_age: ''
      path_x_queue: ''
      path_x_dead_letter_queue: ''
      config_x_debug: ''
      config_x_support_escapes: ''
    custom5:
      pipeline_x_workers: ''
      pipeline_x_batch_x_size: ''
      pipeline_x_batch_x_delay: ''
      pipeline_x_batch_x_metrics_x_sampling_mode: ''
      pipeline_x_ordered: ''
      pipeline_x_ecs_compatibility: ''
      pipeline_x_reloadable: ''
      queue_x_type: ''
      queue_x_max_bytes: ''
      queue_x_page_capacity: ''
      queue_x_max_events: ''
      queue_x_checkpoint_x_acks: ''
      queue_x_checkpoint_x_writes: ''
      queue_x_checkpoint_x_interval: ''
      queue_x_checkpoint_x_retry: ''
      queue_x_compression: ''
      queue_x_drain: ''
      dead_letter_queue_x_enable: ''
      dead_letter_queue_x_max_bytes: ''
      dead_letter_queue_x_flush_interval: ''
      dead_letter_queue_x_flush_check_interval: ''
      dead_letter_queue_x_storage_policy: ''
      dead_letter_queue_x_retain_x_age: ''
      path_x_queue: ''
      path_x_dead_letter_queue: ''
      config_x_debug: ''
      config_x_support_escapes: ''
    custom6:
      pipeline_x_workers: ''
      pipeline_x_batch_x_size: ''
      pipeline_x_batch_x_delay: ''
      pipeline_x_batch_x_metrics_x_sampling_mode: ''
      pipeline_x_ordered: ''
      pipeline_x_ecs_compatibility: ''
      pipeline_x_reloadable: ''
      queue_x_type: ''
      queue_x_max_bytes: ''
      queue_x_page_capacity: ''
      queue_x_max_events: ''
      queue_x_checkpoint_x_acks: ''
      queue_x_checkpoint_x_writes: ''
      queue_x_checkpoint_x_interval: ''
      queue_x_checkpoint_x_retry: ''
      queue_x_compression: ''
      queue_x_drain: ''
      dead_letter_queue_x_enable: ''
      dead_letter_queue_x_max_bytes: ''
      dead_letter_queue_x_flush_interval: ''
      dead_letter_queue_x_flush_check_interval: ''
      dead_letter_queue_x_storage_policy: ''
      dead_letter_queue_x_retain_x_age: ''
      path_x_queue: ''
      path_x_dead_letter_queue: ''
      config_x_debug: ''
      config_x_support_escapes: ''
    custom7:
      pipeline_x_workers: ''
      pipeline_x_batch_x_size: ''
      pipeline_x_batch_x_delay: ''
      pipeline_x_batch_x_metrics_x_sampling_mode: ''
      pipeline_x_ordered: ''
      pipeline_x_ecs_compatibility: ''
      pipeline_x_reloadable: ''
      queue_x_type: ''
      queue_x_max_bytes: ''
      queue_x_page_capacity: ''
      queue_x_max_events: ''
      queue_x_checkpoint_x_acks: ''
      queue_x_checkpoint_x_writes: ''
      queue_x_checkpoint_x_interval: ''
      queue_x_checkpoint_x_retry: ''
      queue_x_compression: ''
      queue_x_drain: ''
      dead_letter_queue_x_enable: ''
      dead_letter_queue_x_max_bytes: ''
      dead_letter_queue_x_flush_interval: ''
      dead_letter_queue_x_flush_check_interval: ''
      dead_letter_queue_x_storage_policy: ''
      dead_letter_queue_x_retain_x_age: ''
      path_x_queue: ''
      path_x_dead_letter_queue: ''
      config_x_debug: ''
      config_x_support_escapes: ''
    custom8:
      pipeline_x_workers: ''
      pipeline_x_batch_x_size: ''
      pipeline_x_batch_x_delay: ''
      pipeline_x_batch_x_metrics_x_sampling_mode: ''
      pipeline_x_ordered: ''
      pipeline_x_ecs_compatibility: ''
      pipeline_x_reloadable: ''
      queue_x_type: ''
      queue_x_max_bytes: ''
      queue_x_page_capacity: ''
      queue_x_max_events: ''
      queue_x_checkpoint_x_acks: ''
      queue_x_checkpoint_x_writes: ''
      queue_x_checkpoint_x_interval: ''
      queue_x_checkpoint_x_retry: ''
      queue_x_compression: ''
      queue_x_drain: ''
      dead_letter_queue_x_enable: ''
      dead_letter_queue_x_max_bytes: ''
      dead_letter_queue_x_flush_interval: ''
      dead_letter_queue_x_flush_check_interval: ''
      dead_letter_queue_x_storage_policy: ''
      dead_letter_queue_x_retain_x_age: ''
      path_x_queue: ''
      path_x_dead_letter_queue: ''
      config_x_debug: ''
      config_x_support_escapes: ''
    custom9:
      pipeline_x_workers: ''
      pipeline_x_batch_x_size: ''
      pipeline_x_batch_x_delay: ''
      pipeline_x_batch_x_metrics_x_sampling_mode: ''
      pipeline_x_ordered: ''
      pipeline_x_ecs_compatibility: ''
      pipeline_x_reloadable: ''
      queue_x_type: ''
      queue_x_max_bytes: ''
      queue_x_page_capacity: ''
      queue_x_max_events: ''
      queue_x_checkpoint_x_acks: ''
      queue_x_checkpoint_x_writes: ''
      queue_x_checkpoint_x_interval: ''
      queue_x_checkpoint_x_retry: ''
      queue_x_compression: ''
      queue_x_drain: ''
      dead_letter_queue_x_enable: ''
      dead_letter_queue_x_max_bytes: ''
      dead_letter_queue_x_flush_interval: ''
      dead_letter_queue_x_flush_check_interval: ''
      dead_letter_queue_x_storage_policy: ''
      dead_letter_queue_x_retain_x_age: ''
      path_x_queue: ''
      path_x_dead_letter_queue: ''
      config_x_debug: ''
      config_x_support_escapes: ''
  settings:
    lsheap: 500m
  config:
    api_x_http_x_host: 0.0.0.0
    log_x_level: info
    log_x_format: plain
    path_x_logs: /var/log/logstash
    pipeline_x_workers: 1
    pipeline_x_batch_x_size: 125
    pipeline_x_ecs_compatibility: disabled
  dmz_nodes: []
  latency_metrics: False