From 49a16c0ff1024f0f165c7fde651cadb7014d0f68 Mon Sep 17 00:00:00 2001 From: Thomas Anderson Date: Mon, 16 Dec 2019 16:44:02 -0500 Subject: [PATCH 01/11] Explain environment variables --- README.md | 67 +++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 67 insertions(+) diff --git a/README.md b/README.md index 7c3c87f6..1325a3c2 100644 --- a/README.md +++ b/README.md @@ -22,10 +22,77 @@ In addition, a docker-compose file is provided to launch the containers mentione * [Wazuh documentation for Docker](https://documentation.wazuh.com/current/docker/index.html) * [Docker hub](https://hub.docker.com/u/wazuh) + ### Setup SSL certificate and Basic Authentication Before starting the environment it is required to provide an SSL certificate (or just generate one self-signed) and setup the basic auth. +Documentation on how to provide these two can be found at [nginx_conf/README.md](nginx_conf/README.md). + + +## Environment Variables + +Default values are included when available. + +### Wazuh +``` +API_USER="foo" # Wazuh API username +API_PASS="bar" # Wazuh API password +``` + +### Nginx +``` +NGINX_NAME="foo" # HTTP basic auth username +NGINX_PWD="bar" # HTTP basic auth password +``` + +### Elasticsearch +``` +ELASTIC_CLUSTER="false" # +CLUSTER_NAME="wazuh" # +CLUSTER_NODE_MASTER="false" # +CLUSTER_NODE_DATA="true" # +CLUSTER_NODE_INGEST="true" # +CLUSTER_NODE_NAME="wazuh-elasticsearch" # +CLUSTER_MASTER_NODE_NAME="master-node" # +CLUSTER_MEMORY_LOCK="true" # +CLUSTER_DISCOVERY_SERVICE="wazuh-elasticsearch" # +CLUSTER_NUMBER_OF_MASTERS="2" # +CLUSTER_MAX_NODES="1" # +CLUSTER_DELAYED_TIMEOUT="1m" # +CLUSTER_INITIAL_MASTER_NODES="wazuh-elasticsearch" # +``` + +### Kibana +``` +PATTERN="" # +CHECKS_PATTERN="" # +CHECKS_TEMPLATE="" # +CHECKS_API="" # +CHECKS_SETUP="" # +EXTENSIONS_PCI="" # +EXTENSIONS_GDPR="" # +EXTENSIONS_AUDIT="" # +EXTENSIONS_OSCAP="" # +EXTENSIONS_CISCAT="" # +EXTENSIONS_AWS="" # +EXTENSIONS_VIRUSTOTAL="" # +EXTENSIONS_OSQUERY="" # +APP_TIMEOUT="" # +WAZUH_SHARDS="" # +WAZUH_REPLICAS="" # +WAZUH_VERSION_SHARDS="" # +WAZUH_VERSION_REPLICAS="" # +IP_SELECTOR="" # +IP_IGNORE="" # +XPACK_RBAC_ENABLED="" # +WAZUH_MONITORING_ENABLED="" # +WAZUH_MONITORING_FREQUENCY="" # +WAZUH_MONITORING_SHARDS="" # +WAZUH_MONITORING_REPLICAS="" # +ADMIN_PRIVILEGES="" # +``` + ## Directory structure wazuh-docker From d5fb09f8e011dd78b6464980f0f33831dd5fbba0 Mon Sep 17 00:00:00 2001 From: Manuel Gutierrez Date: Thu, 2 Apr 2020 11:07:49 +0200 Subject: [PATCH 02/11] Remove outdated nginx section --- README.md | 6 ------ 1 file changed, 6 deletions(-) diff --git a/README.md b/README.md index 1325a3c2..c1d69502 100644 --- a/README.md +++ b/README.md @@ -40,12 +40,6 @@ API_USER="foo" # Wazuh API username API_PASS="bar" # Wazuh API password ``` -### Nginx -``` -NGINX_NAME="foo" # HTTP basic auth username -NGINX_PWD="bar" # HTTP basic auth password -``` - ### Elasticsearch ``` ELASTIC_CLUSTER="false" # From 925aa43915e88fcc06224ea59394aceec36f8857 Mon Sep 17 00:00:00 2001 From: Manuel Gutierrez Date: Wed, 8 Apr 2020 18:03:38 +0200 Subject: [PATCH 03/11] Describe Elastic env vars --- README.md | 26 +++++++++++++------------- 1 file changed, 13 insertions(+), 13 deletions(-) diff --git a/README.md b/README.md index c1d69502..406a3db0 100644 --- a/README.md +++ b/README.md @@ -42,19 +42,19 @@ API_PASS="bar" # Wazuh API password ### Elasticsearch ``` -ELASTIC_CLUSTER="false" # -CLUSTER_NAME="wazuh" # -CLUSTER_NODE_MASTER="false" # -CLUSTER_NODE_DATA="true" # -CLUSTER_NODE_INGEST="true" # -CLUSTER_NODE_NAME="wazuh-elasticsearch" # -CLUSTER_MASTER_NODE_NAME="master-node" # -CLUSTER_MEMORY_LOCK="true" # -CLUSTER_DISCOVERY_SERVICE="wazuh-elasticsearch" # -CLUSTER_NUMBER_OF_MASTERS="2" # -CLUSTER_MAX_NODES="1" # -CLUSTER_DELAYED_TIMEOUT="1m" # -CLUSTER_INITIAL_MASTER_NODES="wazuh-elasticsearch" # +ELASTIC_CLUSTER="false" # Setup a cluster +CLUSTER_NAME="wazuh" # Cluster name +CLUSTER_NODE_MASTER="false" # Set node as master +CLUSTER_NODE_DATA="true" # Store data on this node +CLUSTER_NODE_INGEST="true" # Setup as ingest node +CLUSTER_NODE_NAME="wazuh-elasticsearch" # Name for this node +CLUSTER_MASTER_NODE_NAME="master-node" # Name of the master node +CLUSTER_MEMORY_LOCK="true" # Set Elasticsearch memory lock +CLUSTER_DISCOVERY_SERVICE="wazuh-elasticsearch" # Set discovery service +CLUSTER_NUMBER_OF_MASTERS="2" # Number of masters on the cluster +CLUSTER_MAX_NODES="1" # Max number of nodes on the cluster +CLUSTER_DELAYED_TIMEOUT="1m" # Set delayed timeout +CLUSTER_INITIAL_MASTER_NODES="wazuh-elasticsearch" # Elastic bootstrap node ``` ### Kibana From c44b1545788ecf02960f41e3b4f9287216559dc6 Mon Sep 17 00:00:00 2001 From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com> Date: Tue, 29 Sep 2020 18:01:18 +0200 Subject: [PATCH 04/11] Remove reference to Elasticsearch variables --- README.md | 17 ----------------- 1 file changed, 17 deletions(-) diff --git a/README.md b/README.md index 406a3db0..aa74f1c8 100644 --- a/README.md +++ b/README.md @@ -40,23 +40,6 @@ API_USER="foo" # Wazuh API username API_PASS="bar" # Wazuh API password ``` -### Elasticsearch -``` -ELASTIC_CLUSTER="false" # Setup a cluster -CLUSTER_NAME="wazuh" # Cluster name -CLUSTER_NODE_MASTER="false" # Set node as master -CLUSTER_NODE_DATA="true" # Store data on this node -CLUSTER_NODE_INGEST="true" # Setup as ingest node -CLUSTER_NODE_NAME="wazuh-elasticsearch" # Name for this node -CLUSTER_MASTER_NODE_NAME="master-node" # Name of the master node -CLUSTER_MEMORY_LOCK="true" # Set Elasticsearch memory lock -CLUSTER_DISCOVERY_SERVICE="wazuh-elasticsearch" # Set discovery service -CLUSTER_NUMBER_OF_MASTERS="2" # Number of masters on the cluster -CLUSTER_MAX_NODES="1" # Max number of nodes on the cluster -CLUSTER_DELAYED_TIMEOUT="1m" # Set delayed timeout -CLUSTER_INITIAL_MASTER_NODES="wazuh-elasticsearch" # Elastic bootstrap node -``` - ### Kibana ``` PATTERN="" # From cbcaa2ff055985122138d35772bcd521f88dcdd9 Mon Sep 17 00:00:00 2001 From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com> Date: Tue, 29 Sep 2020 18:15:04 +0200 Subject: [PATCH 05/11] Add extra Wazuh variables --- README.md | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index aa74f1c8..ef889bf6 100644 --- a/README.md +++ b/README.md @@ -36,8 +36,15 @@ Default values are included when available. ### Wazuh ``` -API_USER="foo" # Wazuh API username -API_PASS="bar" # Wazuh API password +API_USER="foo" # Wazuh API username +API_PASS="bar" # Wazuh API password +ELASTICSEARCH_URL=https://elasticsearch:9200 +ELASTIC_USERNAME=admin +ELASTIC_PASSWORD=SecretPassword +FILEBEAT_SSL_VERIFICATION_MODE=full # full or none +SSL_CERTIFICATE_AUTHORITIES=/etc/ssl/root-ca.pem +SSL_CERTIFICATE=/etc/ssl/filebeat.pem +SSL_KEY=/etc/ssl/filebeat.key ``` ### Kibana From 2ed39e43fb81708cdc5c2e69e537d430aa6402d4 Mon Sep 17 00:00:00 2001 From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com> Date: Wed, 21 Oct 2020 16:03:23 +0200 Subject: [PATCH 06/11] Update description of missing variables --- README.md | 75 +++++++++++++++++++++++++++++++------------------------ 1 file changed, 42 insertions(+), 33 deletions(-) diff --git a/README.md b/README.md index ef889bf6..2ee4f00b 100644 --- a/README.md +++ b/README.md @@ -36,45 +36,54 @@ Default values are included when available. ### Wazuh ``` -API_USER="foo" # Wazuh API username -API_PASS="bar" # Wazuh API password -ELASTICSEARCH_URL=https://elasticsearch:9200 -ELASTIC_USERNAME=admin -ELASTIC_PASSWORD=SecretPassword -FILEBEAT_SSL_VERIFICATION_MODE=full # full or none -SSL_CERTIFICATE_AUTHORITIES=/etc/ssl/root-ca.pem -SSL_CERTIFICATE=/etc/ssl/filebeat.pem -SSL_KEY=/etc/ssl/filebeat.key +API_USER="foo" # Wazuh API username +API_PASS="bar" # Wazuh API password +ELASTICSEARCH_URL=https://elasticsearch:9200 # Elasticsearch URL +ELASTIC_USERNAME=admin # Elasticsearch Username +ELASTIC_PASSWORD=SecretPassword # Elasticsearch Password +FILEBEAT_SSL_VERIFICATION_MODE=full # Filebeat SSL Verification mode (full or none) +SSL_CERTIFICATE_AUTHORITIES=/etc/ssl/root-ca.pem # Filebeat SSL CA +SSL_CERTIFICATE=/etc/ssl/filebeat.pem # Filebeat SSL Certificate +SSL_KEY=/etc/ssl/filebeat.key # Filebeat SSL Key ``` ### Kibana ``` -PATTERN="" # -CHECKS_PATTERN="" # -CHECKS_TEMPLATE="" # +PATTERN="" # Default index pattern to use + +CHECKS_PATTERN="" # Defines which checks must to be consider by the healthcheck +CHECKS_TEMPLATE="" # step once the Wazuh app starts. Values must to be true or false CHECKS_API="" # CHECKS_SETUP="" # -EXTENSIONS_PCI="" # -EXTENSIONS_GDPR="" # -EXTENSIONS_AUDIT="" # -EXTENSIONS_OSCAP="" # -EXTENSIONS_CISCAT="" # -EXTENSIONS_AWS="" # -EXTENSIONS_VIRUSTOTAL="" # -EXTENSIONS_OSQUERY="" # -APP_TIMEOUT="" # -WAZUH_SHARDS="" # -WAZUH_REPLICAS="" # -WAZUH_VERSION_SHARDS="" # -WAZUH_VERSION_REPLICAS="" # -IP_SELECTOR="" # -IP_IGNORE="" # -XPACK_RBAC_ENABLED="" # -WAZUH_MONITORING_ENABLED="" # -WAZUH_MONITORING_FREQUENCY="" # -WAZUH_MONITORING_SHARDS="" # -WAZUH_MONITORING_REPLICAS="" # -ADMIN_PRIVILEGES="" # + +EXTENSIONS_PCI="" # Enable PCI Extension +EXTENSIONS_GDPR="" # Enable GDPR Extension +EXTENSIONS_HIPAA="" # Enable HIPAA Extension +EXTENSIONS_NIST="" # Enable NIST Extension +EXTENSIONS_TSC="" # Enable TSC Extension +EXTENSIONS_AUDIT="" # Enable Audit Extension +EXTENSIONS_OSCAP="" # Enable OpenSCAP Extension +EXTENSIONS_CISCAT="" # Enable CISCAT Extension +EXTENSIONS_AWS="" # Enable AWS Extension +EXTENSIONS_GCP="" # Enable GCP Extension +EXTENSIONS_VIRUSTOTAL="" # Enable Virustotal Extension +EXTENSIONS_OSQUERY="" # Enable OSQuery Extension +EXTENSIONS_DOCKER="" # Enable Docker Extension + +APP_TIMEOUT="" # Defines maximum timeout to be used on the Wazuh app requests + +API_SELECTOR="" # Defines if the user is allowed to change the selected API directly from the Wazuh app top menu +IP_SELECTOR="" # Defines if the user is allowed to change the selected index pattern directly from the Wazuh app top menu +IP_IGNORE="" # List of index patterns to be ignored + +XPACK_RBAC_ENABLED="" # Custom setting to enable/disable built-in X-Pack RBAC security capabilities. Default: enabled + +WAZUH_MONITORING_ENABLED="" # Custom settings to enable/disable wazuh-monitoring indices +WAZUH_MONITORING_FREQUENCY="" # Custom setting to set the frequency for wazuh-monitoring indices cron task +WAZUH_MONITORING_SHARDS="" # Configure wazuh-monitoring-* indices shards and replicas +WAZUH_MONITORING_REPLICAS="" # + +ADMIN_PRIVILEGES="" # App privileges ``` ## Directory structure From 1f1a5dd009b476196bbc1278f798059a7445c93d Mon Sep 17 00:00:00 2001 From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com> Date: Wed, 21 Oct 2020 16:19:13 +0200 Subject: [PATCH 07/11] Remove legacy variable --- README.md | 2 -- 1 file changed, 2 deletions(-) diff --git a/README.md b/README.md index 2ee4f00b..fb5fc2cd 100644 --- a/README.md +++ b/README.md @@ -76,8 +76,6 @@ API_SELECTOR="" # Defines if the user is allowed to change the selected IP_SELECTOR="" # Defines if the user is allowed to change the selected index pattern directly from the Wazuh app top menu IP_IGNORE="" # List of index patterns to be ignored -XPACK_RBAC_ENABLED="" # Custom setting to enable/disable built-in X-Pack RBAC security capabilities. Default: enabled - WAZUH_MONITORING_ENABLED="" # Custom settings to enable/disable wazuh-monitoring indices WAZUH_MONITORING_FREQUENCY="" # Custom setting to set the frequency for wazuh-monitoring indices cron task WAZUH_MONITORING_SHARDS="" # Configure wazuh-monitoring-* indices shards and replicas From 1a19c72393efc7306bed6c028c151082a3bbe0bb Mon Sep 17 00:00:00 2001 From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com> Date: Thu, 22 Oct 2020 14:43:46 +0200 Subject: [PATCH 08/11] Update docs on API variables --- README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index fb5fc2cd..71426d1e 100644 --- a/README.md +++ b/README.md @@ -36,8 +36,8 @@ Default values are included when available. ### Wazuh ``` -API_USER="foo" # Wazuh API username -API_PASS="bar" # Wazuh API password +API_USERNAME="my-custom-login" # Wazuh API username +API_PASSWORD="Str0ngP455w0rd.!*-" # Wazuh API password - Must comply with requirements (8+ length, uppercase, lowercase, specials chars) ELASTICSEARCH_URL=https://elasticsearch:9200 # Elasticsearch URL ELASTIC_USERNAME=admin # Elasticsearch Username ELASTIC_PASSWORD=SecretPassword # Elasticsearch Password From ed805ee1c1e3f46ce68fb3153e4d5b9cbb8bc717 Mon Sep 17 00:00:00 2001 From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com> Date: Fri, 23 Oct 2020 11:25:45 +0200 Subject: [PATCH 09/11] Update README with default values --- README.md | 60 +++++++++++++++++++++++++++---------------------------- 1 file changed, 30 insertions(+), 30 deletions(-) diff --git a/README.md b/README.md index 71426d1e..185761cf 100644 --- a/README.md +++ b/README.md @@ -36,11 +36,11 @@ Default values are included when available. ### Wazuh ``` -API_USERNAME="my-custom-login" # Wazuh API username -API_PASSWORD="Str0ngP455w0rd.!*-" # Wazuh API password - Must comply with requirements (8+ length, uppercase, lowercase, specials chars) +API_USERNAME="wazuh" # Wazuh API username +API_PASSWORD="wazuh" # Wazuh API password - Must comply with requirements (8+ length, uppercase, lowercase, specials chars) ELASTICSEARCH_URL=https://elasticsearch:9200 # Elasticsearch URL ELASTIC_USERNAME=admin # Elasticsearch Username -ELASTIC_PASSWORD=SecretPassword # Elasticsearch Password +ELASTIC_PASSWORD=admin # Elasticsearch Password FILEBEAT_SSL_VERIFICATION_MODE=full # Filebeat SSL Verification mode (full or none) SSL_CERTIFICATE_AUTHORITIES=/etc/ssl/root-ca.pem # Filebeat SSL CA SSL_CERTIFICATE=/etc/ssl/filebeat.pem # Filebeat SSL Certificate @@ -49,39 +49,39 @@ SSL_KEY=/etc/ssl/filebeat.key # Filebeat SSL Key ### Kibana ``` -PATTERN="" # Default index pattern to use +PATTERN="wazuh-alerts-*" # Default index pattern to use -CHECKS_PATTERN="" # Defines which checks must to be consider by the healthcheck -CHECKS_TEMPLATE="" # step once the Wazuh app starts. Values must to be true or false -CHECKS_API="" # -CHECKS_SETUP="" # +CHECKS_PATTERN=true # Defines which checks must to be consider by the healthcheck +CHECKS_TEMPLATE=true # step once the Wazuh app starts. Values must to be true or false +CHECKS_API=true +CHECKS_SETUP=true -EXTENSIONS_PCI="" # Enable PCI Extension -EXTENSIONS_GDPR="" # Enable GDPR Extension -EXTENSIONS_HIPAA="" # Enable HIPAA Extension -EXTENSIONS_NIST="" # Enable NIST Extension -EXTENSIONS_TSC="" # Enable TSC Extension -EXTENSIONS_AUDIT="" # Enable Audit Extension -EXTENSIONS_OSCAP="" # Enable OpenSCAP Extension -EXTENSIONS_CISCAT="" # Enable CISCAT Extension -EXTENSIONS_AWS="" # Enable AWS Extension -EXTENSIONS_GCP="" # Enable GCP Extension -EXTENSIONS_VIRUSTOTAL="" # Enable Virustotal Extension -EXTENSIONS_OSQUERY="" # Enable OSQuery Extension -EXTENSIONS_DOCKER="" # Enable Docker Extension +EXTENSIONS_PCI=true # Enable PCI Extension +EXTENSIONS_GDPR=true # Enable GDPR Extension +EXTENSIONS_HIPAA=true # Enable HIPAA Extension +EXTENSIONS_NIST=true # Enable NIST Extension +EXTENSIONS_TSC=true # Enable TSC Extension +EXTENSIONS_AUDIT=true # Enable Audit Extension +EXTENSIONS_OSCAP=false # Enable OpenSCAP Extension +EXTENSIONS_CISCAT=false # Enable CISCAT Extension +EXTENSIONS_AWS=false # Enable AWS Extension +EXTENSIONS_GCP=false # Enable GCP Extension +EXTENSIONS_VIRUSTOTAL=false # Enable Virustotal Extension +EXTENSIONS_OSQUERY=false # Enable OSQuery Extension +EXTENSIONS_DOCKER=false # Enable Docker Extension -APP_TIMEOUT="" # Defines maximum timeout to be used on the Wazuh app requests +APP_TIMEOUT=20000 # Defines maximum timeout to be used on the Wazuh app requests -API_SELECTOR="" # Defines if the user is allowed to change the selected API directly from the Wazuh app top menu -IP_SELECTOR="" # Defines if the user is allowed to change the selected index pattern directly from the Wazuh app top menu -IP_IGNORE="" # List of index patterns to be ignored +API_SELECTOR=true Defines if the user is allowed to change the selected API directly from the Wazuh app top menu +IP_SELECTOR=true # Defines if the user is allowed to change the selected index pattern directly from the Wazuh app top menu +IP_IGNORE="[]" # List of index patterns to be ignored -WAZUH_MONITORING_ENABLED="" # Custom settings to enable/disable wazuh-monitoring indices -WAZUH_MONITORING_FREQUENCY="" # Custom setting to set the frequency for wazuh-monitoring indices cron task -WAZUH_MONITORING_SHARDS="" # Configure wazuh-monitoring-* indices shards and replicas -WAZUH_MONITORING_REPLICAS="" # +WAZUH_MONITORING_ENABLED=true # Custom settings to enable/disable wazuh-monitoring indices +WAZUH_MONITORING_FREQUENCY=900 # Custom setting to set the frequency for wazuh-monitoring indices cron task +WAZUH_MONITORING_SHARDS=2 # Configure wazuh-monitoring-* indices shards and replicas +WAZUH_MONITORING_REPLICAS=0 # -ADMIN_PRIVILEGES="" # App privileges +ADMIN_PRIVILEGES=true # App privileges ``` ## Directory structure From b821942010cdb227b2ed6bee55ec1cf8350b3cfd Mon Sep 17 00:00:00 2001 From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com> Date: Fri, 23 Oct 2020 11:33:23 +0200 Subject: [PATCH 10/11] Improve description formatting --- README.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index 185761cf..2dd0d7e2 100644 --- a/README.md +++ b/README.md @@ -37,7 +37,9 @@ Default values are included when available. ### Wazuh ``` API_USERNAME="wazuh" # Wazuh API username -API_PASSWORD="wazuh" # Wazuh API password - Must comply with requirements (8+ length, uppercase, lowercase, specials chars) +API_PASSWORD="wazuh" # Wazuh API password - Must comply with requirements + # (8+ length, uppercase, lowercase, specials chars) + ELASTICSEARCH_URL=https://elasticsearch:9200 # Elasticsearch URL ELASTIC_USERNAME=admin # Elasticsearch Username ELASTIC_PASSWORD=admin # Elasticsearch Password From 3a3b57445487c2b08ecadda667f97dfc40cf6765 Mon Sep 17 00:00:00 2001 From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com> Date: Fri, 23 Oct 2020 11:35:48 +0200 Subject: [PATCH 11/11] Fix filebeat ssl vars description --- README.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index 2dd0d7e2..bcfb141b 100644 --- a/README.md +++ b/README.md @@ -44,9 +44,9 @@ ELASTICSEARCH_URL=https://elasticsearch:9200 # Elasticsearch URL ELASTIC_USERNAME=admin # Elasticsearch Username ELASTIC_PASSWORD=admin # Elasticsearch Password FILEBEAT_SSL_VERIFICATION_MODE=full # Filebeat SSL Verification mode (full or none) -SSL_CERTIFICATE_AUTHORITIES=/etc/ssl/root-ca.pem # Filebeat SSL CA -SSL_CERTIFICATE=/etc/ssl/filebeat.pem # Filebeat SSL Certificate -SSL_KEY=/etc/ssl/filebeat.key # Filebeat SSL Key +SSL_CERTIFICATE_AUTHORITIES="" # Path of Filebeat SSL CA +SSL_CERTIFICATE="" # Path of Filebeat SSL Certificate +SSL_KEY="" # Path of Filebeat SSL Key ``` ### Kibana