mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2026-09-23 16:14:49 +02:00
Josh Patterson
52fc0cb828
The Logstash log level was hardcoded to info in log4j2.properties, and logstash.yml carried no log.level key, so the only way to raise verbosity for troubleshooting was to hand-edit a file that the next highstate overwrites. Add log_x_level and log_x_format to logstash:config so both render into logstash.yml, annotated as advanced per-node settings with the value sets Logstash 9.3.7 accepts. log4j2.properties gains jinja, so it moves to log4j2.properties.jinja and is rendered by a discrete lslog4j2 state rather than the lsetcsync recurse, which cannot rename. The recurse exclude_pat now matches both names so it neither copies the template verbatim nor lets clean: True delete the rendered file, matching how pipelines.yml is already handled. The appender layout is selected at render time so log.format actually changes the log output instead of being a dead setting, keeping the existing file name so nothing downstream moves. rootLogger.level now follows ls.log.level rather than claiming info regardless of the configured level.
44 lines
1.9 KiB
Django/Jinja
44 lines
1.9 KiB
Django/Jinja
{%- from 'logstash/map.jinja' import LOGSTASH_MERGED -%}
|
|
status = error
|
|
name = LogstashPropertiesConfig
|
|
|
|
#appender.console.type = Console
|
|
#appender.console.name = plain_console
|
|
#appender.console.layout.type = PatternLayout
|
|
#appender.console.layout.pattern = [%d{ISO8601}][%-5p][%-25c] %m%n
|
|
|
|
#appender.json_console.type = Console
|
|
#appender.json_console.name = json_console
|
|
#appender.json_console.layout.type = JSONLayout
|
|
#appender.json_console.layout.compact = true
|
|
#appender.json_console.layout.eventEol = true
|
|
|
|
#Define logging settings.
|
|
appender.rolling.type = RollingFile
|
|
appender.rolling.name = rolling
|
|
appender.rolling.fileName = /var/log/logstash/logstash.log
|
|
{%- if LOGSTASH_MERGED.config.get('log_x_format', 'plain') == 'json' %}
|
|
appender.rolling.layout.type = JSONLayout
|
|
appender.rolling.layout.compact = true
|
|
appender.rolling.layout.eventEol = true
|
|
{%- else %}
|
|
appender.rolling.layout.type = PatternLayout
|
|
appender.rolling.layout.pattern = [%d{ISO8601}][%-5p][%-25c] %.10000m%n
|
|
{%- endif %}
|
|
appender.rolling.filePattern = /var/log/logstash/logstash-%d{yyyy-MM-dd}.log.gz
|
|
appender.rolling.policies.type = Policies
|
|
appender.rolling.policies.time.type = TimeBasedTriggeringPolicy
|
|
appender.rolling.policies.time.interval = 1
|
|
appender.rolling.policies.time.modulate = true
|
|
appender.rolling.policies.size.type = SizeBasedTriggeringPolicy
|
|
appender.rolling.policies.size.size = 1GB
|
|
appender.rolling.strategy.type = DefaultRolloverStrategy
|
|
appender.rolling.strategy.action.type = Delete
|
|
appender.rolling.strategy.action.basepath = /var/log/logstash
|
|
appender.rolling.strategy.action.condition.type = IfFileName
|
|
appender.rolling.strategy.action.condition.glob = *.gz
|
|
appender.rolling.strategy.action.condition.nested_condition.type = IfLastModified
|
|
appender.rolling.strategy.action.condition.nested_condition.age = 7D
|
|
rootLogger.level = ${sys:ls.log.level}
|
|
rootLogger.appenderRef.rolling.ref = rolling
|