securityonion/salt/elasticfleet/files/integrations/grid-nodes_general/elastic-agent-monitor.json

{
  "package": {
    "name": "filestream",
    "version": ""
  },
  "name": "agent-monitor",
  "namespace": "",
  "description": "",
  "policy_ids": [
    "so-grid-nodes_general"
  ],
  "output_id": null,
  "vars": {},
  "inputs": {
    "filestream-filestream": {
      "enabled": true,
      "streams": {
        "filestream.generic": {
          "enabled": true,
          "vars": {
            "paths": [
              "/opt/so/log/agents/agent-monitor.log"
            ],
            "data_stream.dataset": "agentmonitor",
            "pipeline": "elasticagent.monitor",
            "parsers": "",
            "exclude_files": [
              "\\.gz$"
            ],
            "include_files": [],
            "processors": "- decode_json_fields:\n    fields: [\"message\"]\n    target: \"\"\n- add_fields:\n    target: event\n    fields:\n        module: gridmetrics",
            "tags": [],
            "recursive_glob": true,
            "ignore_older": "72h",
            "clean_inactive": -1,
            "harvester_limit": 0,
            "fingerprint": true,
            "fingerprint_offset": 0,
            "fingerprint_length": 64,
            "file_identity_native": false,
            "exclude_lines": [],
            "include_lines": []
          }
        }
      }
    }
  }
}