securityonion/salt/logstash/pipelines/config/so/9600_output_ossec.conf.jinja

output {
  if [module] =~ "ossec" {
    elasticsearch {
      pipeline => "%{module}"
      hosts => "{{ GLOBALS.manager }}"
      user => "{{ ES_USER }}"
      password => "{{ ES_PASS }}"
      index => "so-ossec"
      ssl => true
      ssl_certificate_verification => false
    }
  }
}