Elastic 7-x cloud adaption (#255)

logstash/Dockerfile

@@ -1,5 +1,7 @@
 # Wazuh App Copyright (C) 2019 Wazuh Inc. (License GPLv2)
-FROM docker.elastic.co/logstash/logstash:6.8.2
+
+ARG LOGSTASH_VERSION=7.2.1
+FROM docker.elastic.co/logstash/logstash:${LOGSTASH_VERSION}
 
 COPY --chown=logstash:logstash config/entrypoint.sh /entrypoint.sh
 

logstash/config/01-wazuh.conf

@@ -4,12 +4,16 @@
 input {
     beats {
         port => 5000
-        codec => "json_lines"
 #       ssl => true
 #       ssl_certificate => "/etc/logstash/logstash.crt"
 #       ssl_key => "/etc/logstash/logstash.key"
     }
 }
+filter {
+    json {
+      source => "message"
+    }
+}
 filter {
     if [data][srcip] {
         mutate {
@@ -30,17 +34,16 @@ filter {
     }
     date {
         match => ["timestamp", "ISO8601"]
-        target => "@timestamp"
+        target => "timestamp"
     }
     mutate {
-        remove_field => [ "timestamp", "beat", "input_type", "tags", "count", "@version", "log", "offset", "type", "@src_ip", "host"]
+        remove_field => [ "beat", "input_type", "tags", "count", "@version", "log", "offset", "type", "@src_ip", "host"]
     }
 }
 output {
     elasticsearch {
         hosts => ["elasticsearch:9200"]
         index => "wazuh-alerts-3.x-%{+YYYY.MM.dd}"
-        document_type => "wazuh"
         #user => service_logstash
         #password => service_logstash_internal_password
         #ssl => true

logstash/config/10-entrypoint.sh

@@ -133,12 +133,15 @@ sleep 2
 # Remove credentials file
 ##############################################################################
 
+>&2 echo "Removing unnecessary files."
+
 if [[ "x${SECURITY_CREDENTIALS_FILE}" == "x" ]]; then
   echo "Security credentials file not used. Nothing to do."
 else
   shred -zvu ${SECURITY_CREDENTIALS_FILE}
 fi
 
+>&2 echo "Unnecessary files removed."
 
 ##############################################################################
 # Map environment variables to entries in logstash.yml.