securityonion/salt/elasticfleet/files/integrations/grid-nodes_general/system-grid-nodes.json

{
  "policy_id": "so-grid-nodes_general",
  "package": {
    "name": "system",
    "version": ""
  },
  "name": "system-grid-nodes",
  "namespace": "default",
  "inputs": {
    "system-logfile": {
      "enabled": true,
      "streams": {
        "system.auth": {
          "enabled": true,
          "vars": {
            "paths": [
              "/var/log/auth.log*",
              "/var/log/secure*"
            ],
            "tags": [
              "so-grid-node"
            ]
          }
        },
        "system.syslog": {
          "enabled": true,
          "vars": {
            "paths": [
              "/var/log/messages*",
              "/var/log/syslog*"
            ],
            "tags": [
              "so-grid-node"
            ],
            "processors": "- if:\n    contains:\n      message: \"salt-minion\"\n  then: \n    - dissect:\n        tokenizer: \"%{} %{} %{} %{} %{} %{}: [%{log.level}] %{*}\"\n        field: \"message\"\n        trim_values: \"all\"\n        target_prefix: \"\"\n    - drop_event:\n        when:\n          equals:\n            log.level: \"INFO\""
          }
        }
      }
    },
    "system-winlog": {
      "enabled": false
    },
    "system-system/metrics": {
      "enabled": false
    }
  },
  "force": true
}