securityonion/salt/logstash/pipelines/config/so/9800_output_logscan.conf.jinja

output {
  if [module] =~ "logscan" {
    elasticsearch {
      id => "logscan_pipeline"
      pipeline => "logscan.alert"
      hosts => "{{ GLOBALS.manager }}"
      user => "{{ ES_USER }}"
      password => "{{ ES_PASS }}"
      index => "so-logscan"
      ssl => true
      ssl_certificate_verification => false
    }
  }
}