mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2025-12-15 21:52:47 +01:00
35 lines
1.3 KiB
Django/Jinja
35 lines
1.3 KiB
Django/Jinja
{% set kafka_brokers = salt['pillar.get']('logstash:nodes:receiver', {}) %}
|
|
{% set kafka_on_mngr = salt ['pillar.get']('logstash:nodes:manager', {}) %}
|
|
{% set broker_ips = [] %}
|
|
{% for node, node_data in kafka_brokers.items() %}
|
|
{% do broker_ips.append(node_data['ip'] + ":9092") %}
|
|
{% endfor %}
|
|
{% for node, node_data in kafka_on_mngr.items() %}
|
|
{% do broker_ips.append(node_data['ip'] + ":9092") %}
|
|
{% endfor %}
|
|
{% set bootstrap_servers = "','".join(broker_ips) %}
|
|
|
|
input {
|
|
kafka {
|
|
codec => json
|
|
topics => ['default-logs', 'kratos-logs', 'soc-logs', 'strelka-logs', 'suricata-logs', 'zeek-logs']
|
|
group_id => 'searchnodes'
|
|
client_id => '{{ GLOBALS.hostname }}'
|
|
security_protocol => 'SSL'
|
|
bootstrap_servers => '{{ bootstrap_servers }}'
|
|
ssl_keystore_location => '/usr/share/logstash/kafka-logstash.p12'
|
|
ssl_keystore_password => 'changeit'
|
|
ssl_keystore_type => 'PKCS12'
|
|
ssl_truststore_location => '/etc/pki/ca-trust/extracted/java/cacerts'
|
|
ssl_truststore_password => 'changeit'
|
|
decorate_events => true
|
|
tags => [ "elastic-agent", "input-{{ GLOBALS.hostname}}", "kafka" ]
|
|
}
|
|
}
|
|
filter {
|
|
if ![metadata] {
|
|
mutate {
|
|
rename => { "@metadata" => "metadata" }
|
|
}
|
|
}
|
|
} |