securityonion/salt/logstash/pipelines/config/so/9000_output_zeek.conf.jinja

output {
  if [module] =~ "zeek" and "import" not in [tags] {
    elasticsearch {
      pipeline => "%{module}.%{dataset}"
      hosts => "{{ GLOBALS.manager }}"
      user => "{{ ES_USER }}"
      password => "{{ ES_PASS }}"
      index => "so-zeek"
      ssl => true
      ssl_certificate_verification => false
    }
  }
}