From e6cddf8e1d5ae7072e9f99bd158cbc77ba1e0b77 Mon Sep 17 00:00:00 2001
From: manuasir <manuel.jimenez@wazuh.com>
Date: Tue, 18 Jun 2019 18:56:21 +0200
Subject: [PATCH 1/2] Removed Logstash occurrences

---
 docker-compose.yml            | 14 --------------
 kibana/config/xpack_config.sh |  2 --
 2 files changed, 16 deletions(-)

diff --git a/docker-compose.yml b/docker-compose.yml
index 38727ea4..31ca6356 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -11,20 +11,6 @@ services:
       - "1515:1515"
       - "514:514/udp"
       - "55000:55000"
-    depends_on:
-      - logstash
-  logstash:
-    image: wazuh/wazuh-logstash:3.9.2_7.1.1
-    hostname: logstash
-    restart: always
-    links:
-      - elasticsearch:elasticsearch
-    ports:
-      - "5000:5000"
-    depends_on:
-      - elasticsearch
-    environment:
-      - LS_HEAP_SIZE=2048m
   elasticsearch:
     image: wazuh/wazuh-elasticsearch:3.9.2_7.1.1
     hostname: elasticsearch
diff --git a/kibana/config/xpack_config.sh b/kibana/config/xpack_config.sh
index 0713dcb8..84a1a942 100644
--- a/kibana/config/xpack_config.sh
+++ b/kibana/config/xpack_config.sh
@@ -10,7 +10,6 @@ then
     [xpack.searchprofiler.enabled]=$XPACK_DEVTOOLS
     [xpack.ml.enabled]=$XPACK_ML
     [xpack.canvas.enabled]=$XPACK_CANVAS
-    [xpack.logstash.enabled]=$XPACK_LOGS
     [xpack.infra.enabled]=$XPACK_INFRA
     [xpack.monitoring.enabled]=$XPACK_MONITORING
     [console.enabled]=$XPACK_DEVTOOLS
@@ -29,7 +28,6 @@ xpack.grokdebugger.enabled: $XPACK_DEVTOOLS
 xpack.searchprofiler.enabled: $XPACK_DEVTOOLS
 xpack.ml.enabled: $XPACK_ML
 xpack.canvas.enabled: $XPACK_CANVAS
-xpack.logstash.enabled: $XPACK_LOGS
 xpack.infra.enabled: $XPACK_INFRA
 xpack.monitoring.enabled: $XPACK_MONITORING
 console.enabled: $XPACK_DEVTOOLS

From 8a6225856d5b0791bc1f17a935d0e6daeb2a916d Mon Sep 17 00:00:00 2001
From: manuasir <manuel.jimenez@wazuh.com>
Date: Tue, 18 Jun 2019 18:56:41 +0200
Subject: [PATCH 2/2] Change Elasticsearch output in Filebeat if env var was
 set

---
 wazuh/Dockerfile                   |  9 +++++----
 wazuh/config/01-config_filebeat.sh | 10 ++++++++++
 2 files changed, 15 insertions(+), 4 deletions(-)
 create mode 100644 wazuh/config/01-config_filebeat.sh

diff --git a/wazuh/Dockerfile b/wazuh/Dockerfile
index 4f3849a0..e4a2814c 100644
--- a/wazuh/Dockerfile
+++ b/wazuh/Dockerfile
@@ -32,6 +32,7 @@ COPY config/init.bash /init.bash
 RUN mkdir /entrypoint-scripts
 COPY config/entrypoint.sh /entrypoint.sh
 COPY config/00-wazuh.sh /entrypoint-scripts/00-wazuh.sh
+COPY config/01-config_filebeat.sh /entrypoint-scripts/01-config_filebeat.sh
 
 # Sync calls are due to https://github.com/docker/docker/issues/9547
 RUN chmod 755 /init.bash && \
@@ -40,10 +41,11 @@ RUN chmod 755 /init.bash && \
    curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-${FILEBEAT_VERSION}-amd64.deb &&\
    dpkg -i filebeat-${FILEBEAT_VERSION}-amd64.deb && rm -f filebeat-${FILEBEAT_VERSION}-amd64.deb && \
    chmod 755 /entrypoint.sh && \
-   chmod 755 /entrypoint-scripts/00-wazuh.sh 
+   chmod 755 /entrypoint-scripts/00-wazuh.sh && \
+   chmod 755 /entrypoint-scripts/01-config_filebeat.sh
 
 COPY config/filebeat.yml /etc/filebeat/
-RUN chmod go-w /etc/filebeat/filebeat.yml 
+RUN chmod go-w /etc/filebeat/filebeat.yml
 
 # Setting volumes
 VOLUME ["/var/ossec/data"]
@@ -75,5 +77,4 @@ ADD https://raw.githubusercontent.com/wazuh/wazuh/$TEMPLATE_VERSION/extensions/e
 RUN chmod go-w /etc/filebeat/wazuh-template.json 
 
 # Run all services
-ENTRYPOINT ["/entrypoint.sh"]
-
+ENTRYPOINT ["/entrypoint.sh"]
\ No newline at end of file
diff --git a/wazuh/config/01-config_filebeat.sh b/wazuh/config/01-config_filebeat.sh
new file mode 100644
index 00000000..61cd1c2a
--- /dev/null
+++ b/wazuh/config/01-config_filebeat.sh
@@ -0,0 +1,10 @@
+#!/bin/bash
+# Wazuh App Copyright (C) 2019 Wazuh Inc. (License GPLv2)
+
+set -e
+
+# Modify the output to Elasticsearch if th ELASTICSEARCH_URL is set
+if [ "$ELASTICSEARCH_URL" != "" ]; then
+  >&2 echo "Customize Elasticsearch ouput IP."
+  sed -i 's|http://elasticsearch:9200|'$ELASTICSEARCH_URL'|g' /etc/filebeat/filebeat.yml
+fi
\ No newline at end of file