securityonion/salt/logstash/pipelines/config/so/9034_output_syslog.conf.jinja

output {
  if [module] =~ "syslog" {
    elasticsearch {
      pipeline => "%{module}"
      hosts => "{{ GLOBALS.manager }}"
      user => "{{ ES_USER }}"
      password => "{{ ES_PASS }}"
      index => "so-syslog"
      ssl => true
      ssl_certificate_verification => false
    }
  }
}