From 3ef08ccf6687c09d16b47f1a5e9471f27e7dd273 Mon Sep 17 00:00:00 2001
From: Mayte Ariza <mayte.ariza@wazuh.com>
Date: Sun, 10 Mar 2019 16:38:51 +0100
Subject: [PATCH 01/32] Elasticsearch dockerfile: added repository-s3 plugin

---
 elasticsearch/Dockerfile | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/elasticsearch/Dockerfile b/elasticsearch/Dockerfile
index 1a41604b..b8b200f4 100644
--- a/elasticsearch/Dockerfile
+++ b/elasticsearch/Dockerfile
@@ -21,5 +21,7 @@ COPY --chown=elasticsearch:elasticsearch ./config/load_settings.sh ./
 
 RUN chmod +x ./load_settings.sh
 
+RUN elasticsearch-plugin install --batch repository-s3
+
 ENTRYPOINT ["/entrypoint.sh"]
 CMD ["elasticsearch"]

From c1a33b7185523bc8669234e8ff89c20f53be682f Mon Sep 17 00:00:00 2001
From: AlfonsoRBJ <sitoruizbravo@hotmail.com>
Date: Tue, 19 Mar 2019 14:35:44 +0100
Subject: [PATCH 02/32] kibana welcome

---
 kibana/Dockerfile              |  7 +++++++
 kibana/config/welcome_wazuh.sh | 15 +++++++++++++++
 2 files changed, 22 insertions(+)
 create mode 100644 kibana/config/welcome_wazuh.sh

diff --git a/kibana/Dockerfile b/kibana/Dockerfile
index 8bb08523..b8a29ea8 100644
--- a/kibana/Dockerfile
+++ b/kibana/Dockerfile
@@ -49,6 +49,7 @@ ARG XPACK_DEVTOOLS="true"
 ARG XPACK_MONITORING="true"
 ARG XPACK_APM="true"
 
+ARG CHANGE_WELLCOME="false"
 
 COPY --chown=kibana:kibana ./config/wazuh_app_config.sh ./
 
@@ -66,4 +67,10 @@ RUN ./xpack_config.sh
 
 RUN /usr/local/bin/kibana-docker --optimize
 
+COPY --chown=kibana:kibana ./config/welcome_wazuh.sh ./
+
+RUN chmod +x ./welcome_wazuh.sh
+
+RUN ./welcome_wazuh.sh
+
 ENTRYPOINT /entrypoint.sh
diff --git a/kibana/config/welcome_wazuh.sh b/kibana/config/welcome_wazuh.sh
new file mode 100644
index 00000000..1c94c41c
--- /dev/null
+++ b/kibana/config/welcome_wazuh.sh
@@ -0,0 +1,15 @@
+#!/bin/bash
+
+if [[ $CHANGE_WELLCOME == "true" ]]
+then
+
+    kibana_path="/usr/share/kibana"
+    # Set Wazuh app as the default landing page
+    echo "Set Wazuh app as the default landing page"
+    echo "server.defaultRoute: /app/wazuh" >> /etc/kibana/kibana.yml
+
+    # Redirect Kibana welcome screen to Discover
+    echo "Redirect Kibana welcome screen to Discover"
+    sed -i "s:'/app/kibana#/home':'/app/kibana#/discover':g" $kibana_path/src/ui/public/chrome/directives/global_nav/global_nav.html
+    sed -i "s:'/app/kibana#/home':'/app/kibana#/discover':g" $kibana_path/src/ui/public/chrome/directives/header_global_nav/header_global_nav.js
+fi

From d0df9a06e1c8b62dacea8a081b9c1a7b8f23bf09 Mon Sep 17 00:00:00 2001
From: AlfonsoRBJ <sitoruizbravo@hotmail.com>
Date: Tue, 19 Mar 2019 14:50:12 +0100
Subject: [PATCH 03/32] fix typo

---
 kibana/Dockerfile              | 2 +-
 kibana/config/welcome_wazuh.sh | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/kibana/Dockerfile b/kibana/Dockerfile
index b8a29ea8..1b4c3b92 100644
--- a/kibana/Dockerfile
+++ b/kibana/Dockerfile
@@ -49,7 +49,7 @@ ARG XPACK_DEVTOOLS="true"
 ARG XPACK_MONITORING="true"
 ARG XPACK_APM="true"
 
-ARG CHANGE_WELLCOME="false"
+ARG CHANGE_WELCOME="false"
 
 COPY --chown=kibana:kibana ./config/wazuh_app_config.sh ./
 
diff --git a/kibana/config/welcome_wazuh.sh b/kibana/config/welcome_wazuh.sh
index 1c94c41c..ceb72ed3 100644
--- a/kibana/config/welcome_wazuh.sh
+++ b/kibana/config/welcome_wazuh.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 
-if [[ $CHANGE_WELLCOME == "true" ]]
+if [[ $CHANGE_WELCOME == "true" ]]
 then
 
     kibana_path="/usr/share/kibana"

From 666708c47f7145ad6c66a070b585afa7aaa597f3 Mon Sep 17 00:00:00 2001
From: AlfonsoRBJ <sitoruizbravo@hotmail.com>
Date: Tue, 19 Mar 2019 16:26:14 +0100
Subject: [PATCH 04/32] kibana yml is in other path

---
 kibana/config/welcome_wazuh.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kibana/config/welcome_wazuh.sh b/kibana/config/welcome_wazuh.sh
index ceb72ed3..3ed3586e 100644
--- a/kibana/config/welcome_wazuh.sh
+++ b/kibana/config/welcome_wazuh.sh
@@ -6,7 +6,7 @@ then
     kibana_path="/usr/share/kibana"
     # Set Wazuh app as the default landing page
     echo "Set Wazuh app as the default landing page"
-    echo "server.defaultRoute: /app/wazuh" >> /etc/kibana/kibana.yml
+    echo "server.defaultRoute: /app/wazuh" >> /usr/share/kibana/config/kibana.yml
 
     # Redirect Kibana welcome screen to Discover
     echo "Redirect Kibana welcome screen to Discover"

From e182e0d4f8a5e3255a66866579fb72a26d572ac5 Mon Sep 17 00:00:00 2001
From: AlfonsoRBJ <sitoruizbravo@hotmail.com>
Date: Tue, 19 Mar 2019 16:51:51 +0100
Subject: [PATCH 05/32] change redirect to wazuh app

---
 kibana/config/welcome_wazuh.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/kibana/config/welcome_wazuh.sh b/kibana/config/welcome_wazuh.sh
index 3ed3586e..a42f38f2 100644
--- a/kibana/config/welcome_wazuh.sh
+++ b/kibana/config/welcome_wazuh.sh
@@ -10,6 +10,6 @@ then
 
     # Redirect Kibana welcome screen to Discover
     echo "Redirect Kibana welcome screen to Discover"
-    sed -i "s:'/app/kibana#/home':'/app/kibana#/discover':g" $kibana_path/src/ui/public/chrome/directives/global_nav/global_nav.html
-    sed -i "s:'/app/kibana#/home':'/app/kibana#/discover':g" $kibana_path/src/ui/public/chrome/directives/header_global_nav/header_global_nav.js
+    sed -i "s:'/app/kibana#/home':'/app/wazuh:g" $kibana_path/src/ui/public/chrome/directives/global_nav/global_nav.html
+    sed -i "s:'/app/kibana#/home':'/app/wazuh:g" $kibana_path/src/ui/public/chrome/directives/header_global_nav/header_global_nav.js
 fi

From e6062f28f3b42912940b0f8af2ef6ff5448984e1 Mon Sep 17 00:00:00 2001
From: AlfonsoRBJ <sitoruizbravo@hotmail.com>
Date: Tue, 19 Mar 2019 17:07:01 +0100
Subject: [PATCH 06/32] removing optimize bundles

---
 kibana/Dockerfile | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/kibana/Dockerfile b/kibana/Dockerfile
index 1b4c3b92..a7c44edf 100644
--- a/kibana/Dockerfile
+++ b/kibana/Dockerfile
@@ -65,7 +65,7 @@ RUN chmod +x ./xpack_config.sh
 
 RUN ./xpack_config.sh
 
-RUN /usr/local/bin/kibana-docker --optimize
+RUN rm -rf ./optimize/bundles
 
 COPY --chown=kibana:kibana ./config/welcome_wazuh.sh ./
 
@@ -73,4 +73,6 @@ RUN chmod +x ./welcome_wazuh.sh
 
 RUN ./welcome_wazuh.sh
 
+RUN /usr/local/bin/kibana-docker --optimize
+
 ENTRYPOINT /entrypoint.sh

From 9b0602766fcfde244ff744db9dab39462355897f Mon Sep 17 00:00:00 2001
From: AlfonsoRBJ <sitoruizbravo@hotmail.com>
Date: Tue, 19 Mar 2019 17:43:14 +0100
Subject: [PATCH 07/32] fix typo

---
 kibana/config/welcome_wazuh.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/kibana/config/welcome_wazuh.sh b/kibana/config/welcome_wazuh.sh
index a42f38f2..0bb9a77d 100644
--- a/kibana/config/welcome_wazuh.sh
+++ b/kibana/config/welcome_wazuh.sh
@@ -10,6 +10,6 @@ then
 
     # Redirect Kibana welcome screen to Discover
     echo "Redirect Kibana welcome screen to Discover"
-    sed -i "s:'/app/kibana#/home':'/app/wazuh:g" $kibana_path/src/ui/public/chrome/directives/global_nav/global_nav.html
-    sed -i "s:'/app/kibana#/home':'/app/wazuh:g" $kibana_path/src/ui/public/chrome/directives/header_global_nav/header_global_nav.js
+    sed -i "s:'/app/kibana#/home':'/app/wazuh':g" $kibana_path/src/ui/public/chrome/directives/global_nav/global_nav.html
+    sed -i "s:'/app/kibana#/home':'/app/wazuh':g" $kibana_path/src/ui/public/chrome/directives/header_global_nav/header_global_nav.js
 fi

From b7537453e31af6c8a5a911bb1c246f4a08faeda0 Mon Sep 17 00:00:00 2001
From: AlfonsoRBJ <sitoruizbravo@hotmail.com>
Date: Wed, 20 Mar 2019 15:47:14 +0100
Subject: [PATCH 08/32] Hide undesired links

---
 kibana/Dockerfile              | 2 --
 kibana/config/welcome_wazuh.sh | 8 ++++++++
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/kibana/Dockerfile b/kibana/Dockerfile
index a7c44edf..92beac63 100644
--- a/kibana/Dockerfile
+++ b/kibana/Dockerfile
@@ -65,8 +65,6 @@ RUN chmod +x ./xpack_config.sh
 
 RUN ./xpack_config.sh
 
-RUN rm -rf ./optimize/bundles
-
 COPY --chown=kibana:kibana ./config/welcome_wazuh.sh ./
 
 RUN chmod +x ./welcome_wazuh.sh
diff --git a/kibana/config/welcome_wazuh.sh b/kibana/config/welcome_wazuh.sh
index 0bb9a77d..3deb1e82 100644
--- a/kibana/config/welcome_wazuh.sh
+++ b/kibana/config/welcome_wazuh.sh
@@ -3,6 +3,8 @@
 if [[ $CHANGE_WELCOME == "true" ]]
 then
 
+    rm -rf ./optimize/bundles
+
     kibana_path="/usr/share/kibana"
     # Set Wazuh app as the default landing page
     echo "Set Wazuh app as the default landing page"
@@ -12,4 +14,10 @@ then
     echo "Redirect Kibana welcome screen to Discover"
     sed -i "s:'/app/kibana#/home':'/app/wazuh':g" $kibana_path/src/ui/public/chrome/directives/global_nav/global_nav.html
     sed -i "s:'/app/kibana#/home':'/app/wazuh':g" $kibana_path/src/ui/public/chrome/directives/header_global_nav/header_global_nav.js
+
+    # Redirect Kibana welcome screen to Discover
+    echo "Hide undesired links"
+    sed -i 's#visible: true#visible: false#g' $kibana_path/x-pack/plugins/rollup/public/crud_app/index.js
+    sed -i 's#visible: true#visible: false#g' $kibana_path/x-pack/plugins/license_management/public/management_section.js
 fi
+

From 699f2bb82e32b37714024b21c48eb80f60c62d0f Mon Sep 17 00:00:00 2001
From: AlfonsoRBJ <sitoruizbravo@hotmail.com>
Date: Wed, 20 Mar 2019 16:30:44 +0100
Subject: [PATCH 09/32] fix visible path

---
 kibana/config/welcome_wazuh.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/kibana/config/welcome_wazuh.sh b/kibana/config/welcome_wazuh.sh
index 3deb1e82..0925d57a 100644
--- a/kibana/config/welcome_wazuh.sh
+++ b/kibana/config/welcome_wazuh.sh
@@ -17,7 +17,7 @@ then
 
     # Redirect Kibana welcome screen to Discover
     echo "Hide undesired links"
-    sed -i 's#visible: true#visible: false#g' $kibana_path/x-pack/plugins/rollup/public/crud_app/index.js
-    sed -i 's#visible: true#visible: false#g' $kibana_path/x-pack/plugins/license_management/public/management_section.js
+    sed -i 's#visible: true#visible: false#g' $kibana_path/node_modules/x-pack/plugins/rollup/public/crud_app/index.js
+    sed -i 's#visible: true#visible: false#g' $kibana_path/node_modules/x-pack/plugins/license_management/public/management_section.js
 fi
 

From 6ce25e00c9598ffbc9cc6a8d9fd943797856cd20 Mon Sep 17 00:00:00 2001
From: AlfonsoRBJ <sitoruizbravo@hotmail.com>
Date: Thu, 21 Mar 2019 16:13:53 +0100
Subject: [PATCH 10/32] merge run.sh in new entrypoint.sh

---
 logstash/config/{run.sh => entrypoint.sh} | 19 +++++++++++++++++--
 1 file changed, 17 insertions(+), 2 deletions(-)
 rename logstash/config/{run.sh => entrypoint.sh} (55%)

diff --git a/logstash/config/run.sh b/logstash/config/entrypoint.sh
similarity index 55%
rename from logstash/config/run.sh
rename to logstash/config/entrypoint.sh
index 0ccb2eee..a523ec8f 100644
--- a/logstash/config/run.sh
+++ b/logstash/config/entrypoint.sh
@@ -1,10 +1,12 @@
-#!/bin/bash
+#!/bin/bash -e
 # Wazuh App Copyright (C) 2019 Wazuh Inc. (License GPLv2)
 #
 # OSSEC container bootstrap. See the README for information of the environment
 # variables expected by this script.
 #
 
+
+
 ##############################################################################
 # Customize logstash output ip
 ##############################################################################
@@ -13,4 +15,17 @@ if [ "$LOGSTASH_OUTPUT" != "" ]; then
   sed -i "s/elasticsearch:9200/$LOGSTASH_OUTPUT:9200/" /usr/share/logstash/config/logstash.yml 
 fi
 
-/usr/local/bin/docker-entrypoint
+# Map environment variables to entries in logstash.yml.
+# Note that this will mutate logstash.yml in place if any such settings are found.
+# This may be undesirable, especially if logstash.yml is bind-mounted from the
+# host system.
+
+env2yaml /usr/share/logstash/config/logstash.yml
+
+export LS_JAVA_OPTS="-Dls.cgroup.cpuacct.path.override=/ -Dls.cgroup.cpu.path.override=/ $LS_JAVA_OPTS"
+
+if [[ -z $1 ]] || [[ ${1:0:1} == '-' ]] ; then
+  exec logstash "$@"
+else
+  exec "$@"
+fi

From 3fdba44bfad4c64e24dfb927fb1c78f8e938ded0 Mon Sep 17 00:00:00 2001
From: AlfonsoRBJ <sitoruizbravo@hotmail.com>
Date: Thu, 21 Mar 2019 16:29:48 +0100
Subject: [PATCH 11/32] cond. race for logstash and improve it for kibana

---
 kibana/config/entrypoint.sh   |  6 ++++--
 logstash/Dockerfile           |  2 +-
 logstash/config/entrypoint.sh | 24 +++++++++++++++++++++++-
 3 files changed, 28 insertions(+), 4 deletions(-)

diff --git a/kibana/config/entrypoint.sh b/kibana/config/entrypoint.sh
index c38bb1d7..1ba0a44d 100644
--- a/kibana/config/entrypoint.sh
+++ b/kibana/config/entrypoint.sh
@@ -10,11 +10,13 @@ else
 fi
 
 until curl -XGET $el_url; do
-  >&2 echo "Elastic is unavailable - sleeping"
+  >&2 echo "Elastic is unavailable - sleeping."
   sleep 5
 done
 
->&2 echo "Elastic is up - executing command"
+sleep 10
+
+>&2 echo "Elasticsearch is up."
 
 
 ./wazuh_app_config.sh
diff --git a/logstash/Dockerfile b/logstash/Dockerfile
index 00322375..b53d0806 100644
--- a/logstash/Dockerfile
+++ b/logstash/Dockerfile
@@ -9,4 +9,4 @@ USER root
 COPY config/run.sh /run.sh
 RUN chmod +x /run.sh
 
-ENTRYPOINT ["/run.sh"]
+ENTRYPOINT /entrypoint.sh
diff --git a/logstash/config/entrypoint.sh b/logstash/config/entrypoint.sh
index a523ec8f..4eef7fa7 100644
--- a/logstash/config/entrypoint.sh
+++ b/logstash/config/entrypoint.sh
@@ -1,24 +1,46 @@
-#!/bin/bash -e
+#!/bin/bash
 # Wazuh App Copyright (C) 2019 Wazuh Inc. (License GPLv2)
 #
 # OSSEC container bootstrap. See the README for information of the environment
 # variables expected by this script.
 #
 
+set -e
 
+##############################################################################
+# Waiting for elasticsearch
+##############################################################################
+
+if [ "x${ELASTICSEARCH_URL}" = "x" ]; then
+  el_url="http://elasticsearch:9200"
+else
+  el_url="${ELASTICSEARCH_URL}"
+fi
+
+until curl -XGET $el_url; do
+  >&2 echo "Elastic is unavailable - sleeping."
+  sleep 5
+done
+
+sleep 10
+
+>&2 echo "Elasticsearch is up."
 
 ##############################################################################
 # Customize logstash output ip
 ##############################################################################
 if [ "$LOGSTASH_OUTPUT" != "" ]; then
+  echo "Customize Logstash ouput ip."
   sed -i "s/elasticsearch:9200/$LOGSTASH_OUTPUT:9200/" /usr/share/logstash/pipeline/01-wazuh.conf
   sed -i "s/elasticsearch:9200/$LOGSTASH_OUTPUT:9200/" /usr/share/logstash/config/logstash.yml 
 fi
 
+##############################################################################
 # Map environment variables to entries in logstash.yml.
 # Note that this will mutate logstash.yml in place if any such settings are found.
 # This may be undesirable, especially if logstash.yml is bind-mounted from the
 # host system.
+##############################################################################
 
 env2yaml /usr/share/logstash/config/logstash.yml
 

From 580251104c231e9a65716cc635700c0aad52d14c Mon Sep 17 00:00:00 2001
From: AlfonsoRBJ <sitoruizbravo@hotmail.com>
Date: Thu, 21 Mar 2019 16:34:24 +0100
Subject: [PATCH 12/32] add entrypoint to Dockerfile

---
 logstash/Dockerfile | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/logstash/Dockerfile b/logstash/Dockerfile
index b53d0806..3ad72068 100644
--- a/logstash/Dockerfile
+++ b/logstash/Dockerfile
@@ -1,6 +1,10 @@
 # Wazuh App Copyright (C) 2019 Wazuh Inc. (License GPLv2)
 FROM docker.elastic.co/logstash/logstash:6.5.4
 
+COPY config/entrypoint.sh /entrypoint.sh
+
+RUN chmod 755 /entrypoint.sh
+
 RUN rm -f /usr/share/logstash/pipeline/logstash.conf
 
 COPY config/01-wazuh.conf /usr/share/logstash/pipeline/01-wazuh.conf

From 48e0c75a26794937d6f752d64a3e5cb6f8572e0e Mon Sep 17 00:00:00 2001
From: AlfonsoRBJ <sitoruizbravo@hotmail.com>
Date: Thu, 21 Mar 2019 16:56:22 +0100
Subject: [PATCH 13/32] remove run.sh execution

---
 logstash/Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/logstash/Dockerfile b/logstash/Dockerfile
index 3ad72068..fea745a3 100644
--- a/logstash/Dockerfile
+++ b/logstash/Dockerfile
@@ -1,7 +1,7 @@
 # Wazuh App Copyright (C) 2019 Wazuh Inc. (License GPLv2)
 FROM docker.elastic.co/logstash/logstash:6.5.4
 
-COPY config/entrypoint.sh /entrypoint.sh
+COPY --chown=logstash:logstash config/entrypoint.sh /entrypoint.sh
 
 RUN chmod 755 /entrypoint.sh
 

From 727858f74c4308579bd63f89711669941ecc5e56 Mon Sep 17 00:00:00 2001
From: AlfonsoRBJ <sitoruizbravo@hotmail.com>
Date: Thu, 21 Mar 2019 16:56:52 +0100
Subject: [PATCH 14/32] remove run.sh exe

---
 logstash/Dockerfile | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/logstash/Dockerfile b/logstash/Dockerfile
index fea745a3..205937c9 100644
--- a/logstash/Dockerfile
+++ b/logstash/Dockerfile
@@ -9,8 +9,4 @@ RUN rm -f /usr/share/logstash/pipeline/logstash.conf
 
 COPY config/01-wazuh.conf /usr/share/logstash/pipeline/01-wazuh.conf
 
-USER root
-COPY config/run.sh /run.sh
-RUN chmod +x /run.sh
-
 ENTRYPOINT /entrypoint.sh

From b3114e72935a07d2ee03b08a174e698dab7db08e Mon Sep 17 00:00:00 2001
From: AlfonsoRBJ <sitoruizbravo@hotmail.com>
Date: Thu, 21 Mar 2019 18:25:56 +0100
Subject: [PATCH 15/32] add race condition for wazuh alerts template

---
 kibana/config/entrypoint.sh   | 21 +++++++++++++++++++++
 logstash/config/entrypoint.sh | 19 ++++++++++++++++++-
 2 files changed, 39 insertions(+), 1 deletion(-)

diff --git a/kibana/config/entrypoint.sh b/kibana/config/entrypoint.sh
index 1ba0a44d..fc4baf56 100644
--- a/kibana/config/entrypoint.sh
+++ b/kibana/config/entrypoint.sh
@@ -3,6 +3,10 @@
 
 set -e
 
+##############################################################################
+# Waiting for elasticsearch
+##############################################################################
+
 if [ "x${ELASTICSEARCH_URL}" = "x" ]; then
   el_url="http://elasticsearch:9200"
 else
@@ -19,6 +23,23 @@ sleep 10
 >&2 echo "Elasticsearch is up."
 
 
+##############################################################################
+# Waiting for wazuh alerts template
+##############################################################################
+
+strlen=0
+
+while [[ $strlen -eq 0 ]]
+do
+  template=$(curl $el_url:9200/_cat/templates/wazuh -s)
+  strlen=${#template}
+done
+
+sleep 10
+
+>&2 echo "Wazuh alerts template is load."
+
+
 ./wazuh_app_config.sh
 
 sleep 5
diff --git a/logstash/config/entrypoint.sh b/logstash/config/entrypoint.sh
index 4eef7fa7..32c347ec 100644
--- a/logstash/config/entrypoint.sh
+++ b/logstash/config/entrypoint.sh
@@ -26,11 +26,28 @@ sleep 10
 
 >&2 echo "Elasticsearch is up."
 
+##############################################################################
+# Waiting for wazuh alerts template
+##############################################################################
+
+strlen=0
+
+while [[ $strlen -eq 0 ]]
+do
+  template=$(curl $el_url:9200/_cat/templates/wazuh -s)
+  strlen=${#template}
+done
+
+sleep 10
+
+>&2 echo "Wazuh alerts template is load."
+
 ##############################################################################
 # Customize logstash output ip
 ##############################################################################
+
 if [ "$LOGSTASH_OUTPUT" != "" ]; then
-  echo "Customize Logstash ouput ip."
+  >&2 echo "Customize Logstash ouput ip."
   sed -i "s/elasticsearch:9200/$LOGSTASH_OUTPUT:9200/" /usr/share/logstash/pipeline/01-wazuh.conf
   sed -i "s/elasticsearch:9200/$LOGSTASH_OUTPUT:9200/" /usr/share/logstash/config/logstash.yml 
 fi

From c6793657e71c08efd42af75c1bbf817bc1fd022e Mon Sep 17 00:00:00 2001
From: AlfonsoRBJ <sitoruizbravo@hotmail.com>
Date: Thu, 21 Mar 2019 18:38:28 +0100
Subject: [PATCH 16/32] improve template check

---
 kibana/config/entrypoint.sh   | 3 ++-
 logstash/config/entrypoint.sh | 3 ++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/kibana/config/entrypoint.sh b/kibana/config/entrypoint.sh
index fc4baf56..e2d87ace 100644
--- a/kibana/config/entrypoint.sh
+++ b/kibana/config/entrypoint.sh
@@ -33,11 +33,12 @@ while [[ $strlen -eq 0 ]]
 do
   template=$(curl $el_url:9200/_cat/templates/wazuh -s)
   strlen=${#template}
+  >&2 echo "Wazuh alerts template not loaded - sleeping."
 done
 
 sleep 10
 
->&2 echo "Wazuh alerts template is load."
+>&2 echo "Wazuh alerts template is loaded."
 
 
 ./wazuh_app_config.sh
diff --git a/logstash/config/entrypoint.sh b/logstash/config/entrypoint.sh
index 32c347ec..e394a784 100644
--- a/logstash/config/entrypoint.sh
+++ b/logstash/config/entrypoint.sh
@@ -36,11 +36,12 @@ while [[ $strlen -eq 0 ]]
 do
   template=$(curl $el_url:9200/_cat/templates/wazuh -s)
   strlen=${#template}
+  >&2 echo "Wazuh alerts template not loaded - sleeping."
 done
 
 sleep 10
 
->&2 echo "Wazuh alerts template is load."
+>&2 echo "Wazuh alerts template is loaded."
 
 ##############################################################################
 # Customize logstash output ip

From 283ca42d57a84df2b3d43a6bdd0b10fd59d0d6c9 Mon Sep 17 00:00:00 2001
From: AlfonsoRBJ <sitoruizbravo@hotmail.com>
Date: Thu, 21 Mar 2019 19:13:22 +0100
Subject: [PATCH 17/32] reduce sleep times after pass check

---
 kibana/config/entrypoint.sh   | 5 +++--
 logstash/config/entrypoint.sh | 5 +++--
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/kibana/config/entrypoint.sh b/kibana/config/entrypoint.sh
index e2d87ace..a87e0bfc 100644
--- a/kibana/config/entrypoint.sh
+++ b/kibana/config/entrypoint.sh
@@ -18,7 +18,7 @@ until curl -XGET $el_url; do
   sleep 5
 done
 
-sleep 10
+sleep 2
 
 >&2 echo "Elasticsearch is up."
 
@@ -34,9 +34,10 @@ do
   template=$(curl $el_url:9200/_cat/templates/wazuh -s)
   strlen=${#template}
   >&2 echo "Wazuh alerts template not loaded - sleeping."
+  sleep 2
 done
 
-sleep 10
+sleep 2
 
 >&2 echo "Wazuh alerts template is loaded."
 
diff --git a/logstash/config/entrypoint.sh b/logstash/config/entrypoint.sh
index e394a784..f8b88116 100644
--- a/logstash/config/entrypoint.sh
+++ b/logstash/config/entrypoint.sh
@@ -22,7 +22,7 @@ until curl -XGET $el_url; do
   sleep 5
 done
 
-sleep 10
+sleep 2
 
 >&2 echo "Elasticsearch is up."
 
@@ -37,9 +37,10 @@ do
   template=$(curl $el_url:9200/_cat/templates/wazuh -s)
   strlen=${#template}
   >&2 echo "Wazuh alerts template not loaded - sleeping."
+  sleep 2
 done
 
-sleep 10
+sleep 2
 
 >&2 echo "Wazuh alerts template is loaded."
 

From fc97c3623be46320c4d1d6044279a53752f7b37b Mon Sep 17 00:00:00 2001
From: AlfonsoRBJ <sitoruizbravo@hotmail.com>
Date: Thu, 21 Mar 2019 19:18:17 +0100
Subject: [PATCH 18/32] Update CHANGELOG.md

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index cd900438..55d51374 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -10,6 +10,7 @@ All notable changes to this project will be documented in this file.
 - Adding the option to disable some xpack features. ([#111](https://github.com/wazuh/wazuh-docker/pull/111))
 - Wazuh-Kibana customizable at plugin level. ([#117](https://github.com/wazuh/wazuh-docker/pull/117))
 - Adding env variables for alerts data flow. ([#118](https://github.com/wazuh/wazuh-docker/pull/118))
+- Welcome screen management. ([#133](https://github.com/wazuh/wazuh-docker/pull/133))
 
 ### Changed
 

From 6a82a367119783d4c79b988076292d9c5c2f99cf Mon Sep 17 00:00:00 2001
From: AlfonsoRBJ <sitoruizbravo@hotmail.com>
Date: Thu, 21 Mar 2019 19:27:42 +0100
Subject: [PATCH 19/32] fix typo in elasticsearch url

---
 kibana/config/entrypoint.sh   | 2 +-
 logstash/config/entrypoint.sh | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/kibana/config/entrypoint.sh b/kibana/config/entrypoint.sh
index a87e0bfc..f7788d29 100644
--- a/kibana/config/entrypoint.sh
+++ b/kibana/config/entrypoint.sh
@@ -31,7 +31,7 @@ strlen=0
 
 while [[ $strlen -eq 0 ]]
 do
-  template=$(curl $el_url:9200/_cat/templates/wazuh -s)
+  template=$(curl $el_url/_cat/templates/wazuh -s)
   strlen=${#template}
   >&2 echo "Wazuh alerts template not loaded - sleeping."
   sleep 2
diff --git a/logstash/config/entrypoint.sh b/logstash/config/entrypoint.sh
index f8b88116..88c3d169 100644
--- a/logstash/config/entrypoint.sh
+++ b/logstash/config/entrypoint.sh
@@ -34,7 +34,7 @@ strlen=0
 
 while [[ $strlen -eq 0 ]]
 do
-  template=$(curl $el_url:9200/_cat/templates/wazuh -s)
+  template=$(curl $el_url/_cat/templates/wazuh -s)
   strlen=${#template}
   >&2 echo "Wazuh alerts template not loaded - sleeping."
   sleep 2

From fdca63f5922c094fdeab918fa53f2e465b88637a Mon Sep 17 00:00:00 2001
From: AlfonsoRBJ <sitoruizbravo@hotmail.com>
Date: Thu, 21 Mar 2019 19:38:54 +0100
Subject: [PATCH 20/32] Update CHANGELOG.md

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index cd900438..9df3c64b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -10,6 +10,7 @@ All notable changes to this project will be documented in this file.
 - Adding the option to disable some xpack features. ([#111](https://github.com/wazuh/wazuh-docker/pull/111))
 - Wazuh-Kibana customizable at plugin level. ([#117](https://github.com/wazuh/wazuh-docker/pull/117))
 - Adding env variables for alerts data flow. ([#118](https://github.com/wazuh/wazuh-docker/pull/118))
+- New Logstash entrypoint added. ([#135](https://github.com/wazuh/wazuh-docker/pull/135/files))
 
 ### Changed
 

From 715fb4fdec219c7c8c9826436be6b40292175e56 Mon Sep 17 00:00:00 2001
From: toniMR <toni97sk8@gmail.com>
Date: Fri, 22 Mar 2019 09:52:37 +0100
Subject: [PATCH 21/32] Adding NGINX_CREDENTIALS in nginx/config/entrypoint.sh

---
 nginx/config/entrypoint.sh | 24 ++++++++++++++++++------
 1 file changed, 18 insertions(+), 6 deletions(-)

diff --git a/nginx/config/entrypoint.sh b/nginx/config/entrypoint.sh
index a6eeec9e..ca661412 100644
--- a/nginx/config/entrypoint.sh
+++ b/nginx/config/entrypoint.sh
@@ -1,5 +1,5 @@
-#!/bin/sh
-# Wazuh App Copyright (C) 2019 Wazuh Inc. (License GPLv2)
+#!/bin/bash
+# Wazuh App Copyright (C) 2018 Wazuh Inc. (License GPLv2)
 
 set -e
 
@@ -12,15 +12,27 @@ else
   echo "SSL certificates already present"
 fi
 
-# Configuring default credentiales.
+# Setting users credentials.
 if [ ! -f /etc/nginx/conf.d/kibana.htpasswd ]; then
-  echo "Setting Nginx credentials"
-  echo $NGINX_PWD|htpasswd -i -c /etc/nginx/conf.d/kibana.htpasswd $NGINX_NAME >/dev/null
+  echo "Setting users credentials"
+  if [ ! -z "$NGINX_CREDENTIALS" ]; then
+    IFS=';' read -r -a users <<< "$NGINX_CREDENTIALS"
+    for index in "${!users[@]}"
+    do
+      IFS=':' read -r -a credentials <<< "${users[index]}"
+      if [ $index -eq 0 ]; then
+        echo ${credentials[1]}|htpasswd -i -c /etc/nginx/conf.d/kibana.htpasswd ${credentials[0]} >/dev/null
+      else
+        echo ${credentials[1]}|htpasswd -i /etc/nginx/conf.d/kibana.htpasswd  ${credentials[0]} >/dev/null
+      fi
+    done
+  else
+    echo $NGINX_PWD|htpasswd -i -c /etc/nginx/conf.d/kibana.htpasswd $NGINX_NAME >/dev/null
+  fi
 else
   echo "Kibana credentials already configured"
 fi
 
-
 if [ "x${NGINX_PORT}" = "x" ]; then
   NGINX_PORT=443
 fi

From 12b40b48ee64d36046e73f7971d5b5c46268fe23 Mon Sep 17 00:00:00 2001
From: toniMR <toni97sk8@gmail.com>
Date: Fri, 22 Mar 2019 09:54:32 +0100
Subject: [PATCH 22/32] Adding NGINX_CREDENTIALS in docker-compose.yml

---
 docker-compose.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/docker-compose.yml b/docker-compose.yml
index c4cc56bd..91a0d9fc 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -57,6 +57,7 @@ services:
     restart: always
     environment:
       - NGINX_PORT=443
+      - NGINX_CREDENTIALS
     ports:
       - "80:80"
       - "443:443"

From f3674ff9d9d1d0841d2f7aa8c0bf71c9abe198db Mon Sep 17 00:00:00 2001
From: toniMR <toni97sk8@gmail.com>
Date: Fri, 22 Mar 2019 09:57:02 +0100
Subject: [PATCH 23/32] Changing comment

---
 nginx/config/entrypoint.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nginx/config/entrypoint.sh b/nginx/config/entrypoint.sh
index ca661412..1b395c5b 100644
--- a/nginx/config/entrypoint.sh
+++ b/nginx/config/entrypoint.sh
@@ -1,5 +1,5 @@
 #!/bin/bash
-# Wazuh App Copyright (C) 2018 Wazuh Inc. (License GPLv2)
+# Wazuh App Copyright (C) 2019 Wazuh Inc. (License GPLv2)
 
 set -e
 

From 8823405dd93495c132b359ea65aa7d4ba98c75df Mon Sep 17 00:00:00 2001
From: AlfonsoRBJ <sitoruizbravo@hotmail.com>
Date: Fri, 22 Mar 2019 14:47:22 +0100
Subject: [PATCH 24/32] remove alerts content

---
 wazuh/Dockerfile | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/wazuh/Dockerfile b/wazuh/Dockerfile
index 1031c1d0..5c8fa136 100644
--- a/wazuh/Dockerfile
+++ b/wazuh/Dockerfile
@@ -60,6 +60,9 @@ RUN chmod +x /etc/service/wazuh-api/run && \
     chmod +x /etc/service/postfix/run && \
     chmod +x /etc/service/filebeat/run 
 
+RUN echo -n > /var/ossec/logs/alerts/alerts.json
+RUN echo -n > /var/ossec/logs/alerts/alerts.log
+
 # Run all services
 ENTRYPOINT ["/entrypoint.sh"]
 

From 92d957730c86c82c72582248fc7fdfe73c213973 Mon Sep 17 00:00:00 2001
From: AlfonsoRBJ <sitoruizbravo@hotmail.com>
Date: Mon, 25 Mar 2019 17:36:27 +0100
Subject: [PATCH 25/32] remove alerts on build time

---
 wazuh/Dockerfile | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/wazuh/Dockerfile b/wazuh/Dockerfile
index 5c8fa136..ff9a940d 100644
--- a/wazuh/Dockerfile
+++ b/wazuh/Dockerfile
@@ -17,7 +17,8 @@ RUN set -x && echo "deb https://packages.wazuh.com/3.x/apt/ stable main" | tee /
 RUN add-apt-repository universe && apt-get update && apt-get upgrade -y -o Dpkg::Options::="--force-confold" && \
    apt-get --no-install-recommends --no-install-suggests -y install openssl postfix bsd-mailx python-boto python-pip  \
    apt-transport-https vim expect nodejs python-cryptography mailutils libsasl2-modules wazuh-manager=${WAZUH_VERSION} \
-   wazuh-api=${WAZUH_VERSION} && apt-get clean && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
+   wazuh-api=${WAZUH_VERSION} && apt-get clean && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* && rm -f \
+   /var/ossec/logs/alerts/*/*/*.log && rm -f /var/ossec/logs/alerts/*/*/*.json
 
 # Adding first run script and entrypoint
 COPY config/data_dirs.env /data_dirs.env
@@ -60,9 +61,6 @@ RUN chmod +x /etc/service/wazuh-api/run && \
     chmod +x /etc/service/postfix/run && \
     chmod +x /etc/service/filebeat/run 
 
-RUN echo -n > /var/ossec/logs/alerts/alerts.json
-RUN echo -n > /var/ossec/logs/alerts/alerts.log
-
 # Run all services
 ENTRYPOINT ["/entrypoint.sh"]
 

From be9c278a186a1b6dc53b5016605db251447d29eb Mon Sep 17 00:00:00 2001
From: AlfonsoRBJ <sitoruizbravo@hotmail.com>
Date: Mon, 25 Mar 2019 17:45:24 +0100
Subject: [PATCH 26/32] Update CHANGELOG.md

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5a3aa5c1..7132e4b9 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -12,6 +12,7 @@ All notable changes to this project will be documented in this file.
 - Adding env variables for alerts data flow. ([#118](https://github.com/wazuh/wazuh-docker/pull/118))
 - New Logstash entrypoint added. ([#135](https://github.com/wazuh/wazuh-docker/pull/135/files))
 - Welcome screen management. ([#133](https://github.com/wazuh/wazuh-docker/pull/133))
+- Remove alerts created in build time. ([#137](https://github.com/wazuh/wazuh-docker/pull/137))
 
 
 ### Changed

From 62af977067498442e619cc35fee0dc3f17770baa Mon Sep 17 00:00:00 2001
From: AlfonsoRBJ <sitoruizbravo@hotmail.com>
Date: Mon, 25 Mar 2019 17:46:12 +0100
Subject: [PATCH 27/32] Update CHANGELOG.md

---
 CHANGELOG.md | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7132e4b9..61093b6a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -12,13 +12,16 @@ All notable changes to this project will be documented in this file.
 - Adding env variables for alerts data flow. ([#118](https://github.com/wazuh/wazuh-docker/pull/118))
 - New Logstash entrypoint added. ([#135](https://github.com/wazuh/wazuh-docker/pull/135/files))
 - Welcome screen management. ([#133](https://github.com/wazuh/wazuh-docker/pull/133))
-- Remove alerts created in build time. ([#137](https://github.com/wazuh/wazuh-docker/pull/137))
-
 
 ### Changed
 
 - Update to Wazuh version 3.8.2. ([#105](https://github.com/wazuh/wazuh-docker/pull/105))
 
+### Removed
+
+- Remove alerts created in build time. ([#137](https://github.com/wazuh/wazuh-docker/pull/137))
+
+
 ## Wazuh Docker v3.8.1_6.5.4
 
 ### Changed

From 11108631c05bf888890195325c67ae65ad3b6693 Mon Sep 17 00:00:00 2001
From: toniMR <toni97sk8@gmail.com>
Date: Tue, 26 Mar 2019 13:26:09 +0100
Subject: [PATCH 28/32] Adding comments

---
 nginx/config/entrypoint.sh | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/nginx/config/entrypoint.sh b/nginx/config/entrypoint.sh
index 1b395c5b..385d7aa8 100644
--- a/nginx/config/entrypoint.sh
+++ b/nginx/config/entrypoint.sh
@@ -13,6 +13,15 @@ else
 fi
 
 # Setting users credentials.
+# In order to set NGINX_CREDENTIALS, before "docker-compose up -d" run (a or b):
+#
+# a) export NGINX_CREDENTIALS="user1:pass1;user2:pass2;" or
+#    export NGINX_CREDENTIALS="user1:pass1;user2:pass2"
+#
+# b) Set NGINX_CREDENTIALS in docker-compose.yml:
+#    NGINX_CREDENTIALS=user1:pass1;user2:pass2; or
+#    NGINX_CREDENTIALS=user1:pass1;user2:pass2
+#
 if [ ! -f /etc/nginx/conf.d/kibana.htpasswd ]; then
   echo "Setting users credentials"
   if [ ! -z "$NGINX_CREDENTIALS" ]; then
@@ -27,6 +36,7 @@ if [ ! -f /etc/nginx/conf.d/kibana.htpasswd ]; then
       fi
     done
   else
+    # NGINX_PWD and NGINX_NAME are declared in nginx/Dockerfile 
     echo $NGINX_PWD|htpasswd -i -c /etc/nginx/conf.d/kibana.htpasswd $NGINX_NAME >/dev/null
   fi
 else

From b15d61cda79735418852ac7c6ab1e3cb3a031313 Mon Sep 17 00:00:00 2001
From: Mayte Ariza <mayte.ariza@wazuh.com>
Date: Tue, 26 Mar 2019 14:20:38 +0100
Subject: [PATCH 29/32] Added script configure_s3.sh to Elasticsearch
 Dockerfile

---
 elasticsearch/Dockerfile              |  5 +++
 elasticsearch/config/configure_s3.sh  | 53 +++++++++++++++++++++++++++
 elasticsearch/config/load_settings.sh | 19 ++++++++++
 3 files changed, 77 insertions(+)
 create mode 100644 elasticsearch/config/configure_s3.sh

diff --git a/elasticsearch/Dockerfile b/elasticsearch/Dockerfile
index b8b200f4..30a2cd0a 100644
--- a/elasticsearch/Dockerfile
+++ b/elasticsearch/Dockerfile
@@ -9,6 +9,8 @@ ENV API_USER="foo" \
 
 ENV XPACK_ML="true" 
 
+ENV ENABLE_CONFIGURE_S3="false"
+
 ENV TEMPLATE_VERSION=v3.8.2
 
 ADD https://raw.githubusercontent.com/wazuh/wazuh/$TEMPLATE_VERSION/extensions/elasticsearch/wazuh-elastic6-template-alerts.json /usr/share/elasticsearch/config
@@ -23,5 +25,8 @@ RUN chmod +x ./load_settings.sh
 
 RUN elasticsearch-plugin install --batch repository-s3
 
+COPY config/configure_s3.sh ./config/configure_s3.sh
+RUN chmod 755 ./config/configure_s3.sh
+
 ENTRYPOINT ["/entrypoint.sh"]
 CMD ["elasticsearch"]
diff --git a/elasticsearch/config/configure_s3.sh b/elasticsearch/config/configure_s3.sh
new file mode 100644
index 00000000..ca5db9a6
--- /dev/null
+++ b/elasticsearch/config/configure_s3.sh
@@ -0,0 +1,53 @@
+#!/bin/bash
+
+# Check arguments
+function CheckArgs()
+{
+    if [ $1 != 4 ] && [ $1 != 5 ];then
+        echo "Use: configure_s3.sh <Elastic_Server_IP:Port> <Bucket> <Path> <RepositoryName> (By default /elasticsearch/<current_elasticsearch_major_version> is added to the path)"
+        echo "or use: configure_s3.sh <Elastic_Server_IP:Port> <Bucket> <Path> <RepositoryName> <Elasticsearch major version>" 
+        exit 1
+
+    fi
+}
+
+# Create repository from base_path <path>/elasticsearch/<current_elasticsearch_major_version> (this last one is automatically added by the script itself, no arg version needed)
+# Repository name would be "s3-repository-" plus the current elasticsearch_major_version
+function CreateRepo()
+{
+
+    elastic_ip_port="$2"
+    bucket_name="$3"
+    path="$4"
+    repository_name="$5"
+
+    if [ $1 == 5 ];then
+        version="$6"
+    else
+        version=`curl -s $elastic_ip_port | grep number | cut -d"\"" -f4 | cut -c1`
+    fi
+
+    repository="$repository_name-$version"
+    s3_path="$path/elasticsearch/$version"
+
+    curl -X PUT "$elastic_ip_port/_snapshot/$repository" -H 'Content-Type: application/json' -d'
+        {
+            "type": "s3",
+            "settings": {
+            "bucket": "'$bucket_name'",
+            "base_path": "'$s3_path'"
+        }
+    }
+    '
+
+}
+
+
+function Main()
+{
+    CheckArgs $1
+
+    CreateRepo $1 $2 $3 $4 $5 $6
+}
+
+    Main $# $1 $2 $3 $4 $5
\ No newline at end of file
diff --git a/elasticsearch/config/load_settings.sh b/elasticsearch/config/load_settings.sh
index bac61378..bce7dd90 100644
--- a/elasticsearch/config/load_settings.sh
+++ b/elasticsearch/config/load_settings.sh
@@ -23,6 +23,25 @@ done
 
 >&2 echo "Elastic is up - executing command"
 
+if [ $ENABLE_CONFIGURE_S3 ]; then
+
+  sleep 10
+  IP_PORT="${ELASTICSEARCH_IP}:${ELASTICSEARCH_PORT}"
+
+  if [ "x$S3_PATH" != "x" ]; then 
+
+    if [ "x$S3_ELASTIC_MAJOR" != "x" ]; then 
+      ./config/configure_s3.sh $IP_PORT $S3_BUCKET_NAME $S3_PATH $S3_REPOSITORY_NAME $S3_ELASTIC_MAJOR 
+
+    else
+      ./config/configure_s3.sh $IP_PORT $S3_BUCKET_NAME $S3_PATH $S3_REPOSITORY_NAME 
+
+    fi
+
+  fi
+
+fi
+
 #Insert default templates
 
 sed -i 's|    "index.refresh_interval": "5s"|    "index.refresh_interval": "5s",    "number_of_shards" :   '"${ALERTS_SHARDS}"',    "number_of_replicas" : '"${ALERTS_REPLICAS}"'|' /usr/share/elasticsearch/config/wazuh-elastic6-template-alerts.json

From ebca6b36967183202cfbf481f4c2e62135758e35 Mon Sep 17 00:00:00 2001
From: l <luisgguijarro9@gmail.com>
Date: Tue, 26 Mar 2019 16:30:50 +0100
Subject: [PATCH 30/32] Fixing duplicate alerts with kubernetes

---
 wazuh/config/filebeat.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/wazuh/config/filebeat.yml b/wazuh/config/filebeat.yml
index 1835863b..bb02a5d8 100644
--- a/wazuh/config/filebeat.yml
+++ b/wazuh/config/filebeat.yml
@@ -8,6 +8,7 @@ filebeat:
     json.message_key: log
     json.keys_under_root: true
     json.overwrite_keys: true
+    tail_files: true
 
 output:
  logstash:

From 1bc6ecca67c31e52c8d9efd492e0a76f5c1c0205 Mon Sep 17 00:00:00 2001
From: Mayte Ariza <mayte.ariza@wazuh.com>
Date: Wed, 27 Mar 2019 10:04:24 +0100
Subject: [PATCH 31/32] Elasticsearch major version checked and repository base
 path changed

---
 elasticsearch/config/configure_s3.sh  | 17 ++++++++++++-----
 elasticsearch/config/load_settings.sh |  2 +-
 2 files changed, 13 insertions(+), 6 deletions(-)

diff --git a/elasticsearch/config/configure_s3.sh b/elasticsearch/config/configure_s3.sh
index ca5db9a6..5ec80832 100644
--- a/elasticsearch/config/configure_s3.sh
+++ b/elasticsearch/config/configure_s3.sh
@@ -1,18 +1,20 @@
 #!/bin/bash
 
+set -e
+
 # Check arguments
 function CheckArgs()
 {
     if [ $1 != 4 ] && [ $1 != 5 ];then
-        echo "Use: configure_s3.sh <Elastic_Server_IP:Port> <Bucket> <Path> <RepositoryName> (By default /elasticsearch/<current_elasticsearch_major_version> is added to the path)"
+        echo "Use: configure_s3.sh <Elastic_Server_IP:Port> <Bucket> <Path> <RepositoryName> (By default <current_elasticsearch_major_version> is added to the path and the repository name)"
         echo "or use: configure_s3.sh <Elastic_Server_IP:Port> <Bucket> <Path> <RepositoryName> <Elasticsearch major version>" 
         exit 1
 
     fi
 }
 
-# Create repository from base_path <path>/elasticsearch/<current_elasticsearch_major_version> (this last one is automatically added by the script itself, no arg version needed)
-# Repository name would be "s3-repository-" plus the current elasticsearch_major_version
+# Create repository from base_path <path>/<elasticsearch_major_version> (if there is no <Elasticsearch major version> argument, current version is added)
+# Repository name would be <RepositoryName>-<elasticsearch_major_version> (if there is no <Elasticsearch major version> argument, current version is added)
 function CreateRepo()
 {
 
@@ -27,8 +29,13 @@ function CreateRepo()
         version=`curl -s $elastic_ip_port | grep number | cut -d"\"" -f4 | cut -c1`
     fi
 
+    if ! [[ "$version" =~ ^[0-9]+$ ]];then
+        echo "Elasticsearch major version must be an integer"
+        exit 1
+    fi
+
     repository="$repository_name-$version"
-    s3_path="$path/elasticsearch/$version"
+    s3_path="$path/$version"
 
     curl -X PUT "$elastic_ip_port/_snapshot/$repository" -H 'Content-Type: application/json' -d'
         {
@@ -50,4 +57,4 @@ function Main()
     CreateRepo $1 $2 $3 $4 $5 $6
 }
 
-    Main $# $1 $2 $3 $4 $5
\ No newline at end of file
+Main $# $1 $2 $3 $4 $5
\ No newline at end of file
diff --git a/elasticsearch/config/load_settings.sh b/elasticsearch/config/load_settings.sh
index bce7dd90..17154c29 100644
--- a/elasticsearch/config/load_settings.sh
+++ b/elasticsearch/config/load_settings.sh
@@ -24,7 +24,7 @@ done
 >&2 echo "Elastic is up - executing command"
 
 if [ $ENABLE_CONFIGURE_S3 ]; then
-
+  #Wait for Elasticsearch to be ready to create the repository
   sleep 10
   IP_PORT="${ELASTICSEARCH_IP}:${ELASTICSEARCH_PORT}"
 

From 91e70da2b8793a29e1cfdb7aec0550c344bf343b Mon Sep 17 00:00:00 2001
From: Mayte Ariza <mayte.ariza@wazuh.com>
Date: Wed, 27 Mar 2019 12:48:12 +0100
Subject: [PATCH 32/32] Configure_s3.sh: comments added

---
 elasticsearch/config/configure_s3.sh | 20 ++++++++++++++++++--
 1 file changed, 18 insertions(+), 2 deletions(-)

diff --git a/elasticsearch/config/configure_s3.sh b/elasticsearch/config/configure_s3.sh
index 5ec80832..49c88a25 100644
--- a/elasticsearch/config/configure_s3.sh
+++ b/elasticsearch/config/configure_s3.sh
@@ -2,7 +2,9 @@
 
 set -e
 
-# Check arguments
+# Check number of arguments passed to configure_s3.sh. If it is different from 4 or 5, the process will finish with error.
+# param 1: number of arguments passed to configure_s3.sh
+
 function CheckArgs()
 {
     if [ $1 != 4 ] && [ $1 != 5 ];then
@@ -13,8 +15,15 @@ function CheckArgs()
     fi
 }
 
-# Create repository from base_path <path>/<elasticsearch_major_version> (if there is no <Elasticsearch major version> argument, current version is added)
+# Create S3 repository from base_path <path>/<elasticsearch_major_version> (if there is no <Elasticsearch major version> argument, current version is added)
 # Repository name would be <RepositoryName>-<elasticsearch_major_version> (if there is no <Elasticsearch major version> argument, current version is added)
+# param 1: <Elastic_Server_IP:Port>
+# param 2: <Bucket>
+# param 3: <Path>
+# param 4: <RepositoryName>
+# param 5: Optional <Elasticsearch major version>
+# output: It will show "acknowledged" if the repository has been successfully created
+
 function CreateRepo()
 {
 
@@ -49,6 +58,13 @@ function CreateRepo()
 
 }
 
+# Run functions CheckArgs and CreateRepo
+# param 1: number of arguments passed to configure_s3.sh
+# param 2: <Elastic_Server_IP:Port>
+# param 3: <Bucket>
+# param 4: <Path>
+# param 5: <RepositoryName>
+# param 6: Optional <Elasticsearch major version>
 
 function Main()
 {