logstash:
  pipelines:
    helix:
      config:
        - so/0010_input_hhbeats.conf
        - so/1033_preprocess_snort.conf
        - so/1100_preprocess_bro_conn.conf
        - so/1101_preprocess_bro_dhcp.conf
        - so/1102_preprocess_bro_dns.conf
        - so/1103_preprocess_bro_dpd.conf
        - so/1104_preprocess_bro_files.conf
        - so/1105_preprocess_bro_ftp.conf
        - so/1106_preprocess_bro_http.conf
        - so/1107_preprocess_bro_irc.conf
        - so/1108_preprocess_bro_kerberos.conf
        - so/1109_preprocess_bro_notice.conf
        - so/1110_preprocess_bro_rdp.conf
        - so/1111_preprocess_bro_signatures.conf
        - so/1112_preprocess_bro_smtp.conf
        - so/1113_preprocess_bro_snmp.conf
        - so/1114_preprocess_bro_software.conf
        - so/1115_preprocess_bro_ssh.conf
        - so/1116_preprocess_bro_ssl.conf
        - so/1117_preprocess_bro_syslog.conf
        - so/1118_preprocess_bro_tunnel.conf
        - so/1119_preprocess_bro_weird.conf
        - so/1121_preprocess_bro_mysql.conf
        - so/1122_preprocess_bro_socks.conf
        - so/1123_preprocess_bro_x509.conf
        - so/1124_preprocess_bro_intel.conf
        - so/1125_preprocess_bro_modbus.conf
        - so/1126_preprocess_bro_sip.conf
        - so/1127_preprocess_bro_radius.conf
        - so/1128_preprocess_bro_pe.conf
        - so/1129_preprocess_bro_rfb.conf
        - so/1130_preprocess_bro_dnp3.conf
        - so/1131_preprocess_bro_smb_files.conf
        - so/1132_preprocess_bro_smb_mapping.conf
        - so/1133_preprocess_bro_ntlm.conf
        - so/1134_preprocess_bro_dce_rpc.conf
        - so/8001_postprocess_common_ip_augmentation.conf
        - so/9997_output_helix.conf.jinja