securityonion/salt/logstash/pipelines/config/so/9400_output_suricata.conf.jinja

output {
  if [module] =~ "suricata" and "import" not in [tags] {
    elasticsearch {
      pipeline => "%{module}.%{dataset}"
      hosts => "{{ GLOBALS.manager }}"
      user => "{{ ES_USER }}"
      password => "{{ ES_PASS }}"
      index => "so-ids"
      ssl => true
      ssl_certificate_verification => false
    }
  }
}