diff --git a/CHANGELOG.md b/CHANGELOG.md index 55d51374..5a3aa5c1 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -10,8 +10,10 @@ All notable changes to this project will be documented in this file. - Adding the option to disable some xpack features. ([#111](https://github.com/wazuh/wazuh-docker/pull/111)) - Wazuh-Kibana customizable at plugin level. ([#117](https://github.com/wazuh/wazuh-docker/pull/117)) - Adding env variables for alerts data flow. ([#118](https://github.com/wazuh/wazuh-docker/pull/118)) +- New Logstash entrypoint added. ([#135](https://github.com/wazuh/wazuh-docker/pull/135/files)) - Welcome screen management. ([#133](https://github.com/wazuh/wazuh-docker/pull/133)) + ### Changed - Update to Wazuh version 3.8.2. ([#105](https://github.com/wazuh/wazuh-docker/pull/105)) diff --git a/kibana/config/entrypoint.sh b/kibana/config/entrypoint.sh index c38bb1d7..f7788d29 100644 --- a/kibana/config/entrypoint.sh +++ b/kibana/config/entrypoint.sh @@ -3,6 +3,10 @@ set -e +############################################################################## +# Waiting for elasticsearch +############################################################################## + if [ "x${ELASTICSEARCH_URL}" = "x" ]; then el_url="http://elasticsearch:9200" else @@ -10,11 +14,32 @@ else fi until curl -XGET $el_url; do - >&2 echo "Elastic is unavailable - sleeping" + >&2 echo "Elastic is unavailable - sleeping." sleep 5 done ->&2 echo "Elastic is up - executing command" +sleep 2 + +>&2 echo "Elasticsearch is up." + + +############################################################################## +# Waiting for wazuh alerts template +############################################################################## + +strlen=0 + +while [[ $strlen -eq 0 ]] +do + template=$(curl $el_url/_cat/templates/wazuh -s) + strlen=${#template} + >&2 echo "Wazuh alerts template not loaded - sleeping." + sleep 2 +done + +sleep 2 + +>&2 echo "Wazuh alerts template is loaded." ./wazuh_app_config.sh diff --git a/logstash/Dockerfile b/logstash/Dockerfile index 00322375..205937c9 100644 --- a/logstash/Dockerfile +++ b/logstash/Dockerfile @@ -1,12 +1,12 @@ # Wazuh App Copyright (C) 2019 Wazuh Inc. (License GPLv2) FROM docker.elastic.co/logstash/logstash:6.5.4 +COPY --chown=logstash:logstash config/entrypoint.sh /entrypoint.sh + +RUN chmod 755 /entrypoint.sh + RUN rm -f /usr/share/logstash/pipeline/logstash.conf COPY config/01-wazuh.conf /usr/share/logstash/pipeline/01-wazuh.conf -USER root -COPY config/run.sh /run.sh -RUN chmod +x /run.sh - -ENTRYPOINT ["/run.sh"] +ENTRYPOINT /entrypoint.sh diff --git a/logstash/config/entrypoint.sh b/logstash/config/entrypoint.sh new file mode 100644 index 00000000..88c3d169 --- /dev/null +++ b/logstash/config/entrypoint.sh @@ -0,0 +1,72 @@ +#!/bin/bash +# Wazuh App Copyright (C) 2019 Wazuh Inc. (License GPLv2) +# +# OSSEC container bootstrap. See the README for information of the environment +# variables expected by this script. +# + +set -e + +############################################################################## +# Waiting for elasticsearch +############################################################################## + +if [ "x${ELASTICSEARCH_URL}" = "x" ]; then + el_url="http://elasticsearch:9200" +else + el_url="${ELASTICSEARCH_URL}" +fi + +until curl -XGET $el_url; do + >&2 echo "Elastic is unavailable - sleeping." + sleep 5 +done + +sleep 2 + +>&2 echo "Elasticsearch is up." + +############################################################################## +# Waiting for wazuh alerts template +############################################################################## + +strlen=0 + +while [[ $strlen -eq 0 ]] +do + template=$(curl $el_url/_cat/templates/wazuh -s) + strlen=${#template} + >&2 echo "Wazuh alerts template not loaded - sleeping." + sleep 2 +done + +sleep 2 + +>&2 echo "Wazuh alerts template is loaded." + +############################################################################## +# Customize logstash output ip +############################################################################## + +if [ "$LOGSTASH_OUTPUT" != "" ]; then + >&2 echo "Customize Logstash ouput ip." + sed -i "s/elasticsearch:9200/$LOGSTASH_OUTPUT:9200/" /usr/share/logstash/pipeline/01-wazuh.conf + sed -i "s/elasticsearch:9200/$LOGSTASH_OUTPUT:9200/" /usr/share/logstash/config/logstash.yml +fi + +############################################################################## +# Map environment variables to entries in logstash.yml. +# Note that this will mutate logstash.yml in place if any such settings are found. +# This may be undesirable, especially if logstash.yml is bind-mounted from the +# host system. +############################################################################## + +env2yaml /usr/share/logstash/config/logstash.yml + +export LS_JAVA_OPTS="-Dls.cgroup.cpuacct.path.override=/ -Dls.cgroup.cpu.path.override=/ $LS_JAVA_OPTS" + +if [[ -z $1 ]] || [[ ${1:0:1} == '-' ]] ; then + exec logstash "$@" +else + exec "$@" +fi diff --git a/logstash/config/run.sh b/logstash/config/run.sh deleted file mode 100644 index 0ccb2eee..00000000 --- a/logstash/config/run.sh +++ /dev/null @@ -1,16 +0,0 @@ -#!/bin/bash -# Wazuh App Copyright (C) 2019 Wazuh Inc. (License GPLv2) -# -# OSSEC container bootstrap. See the README for information of the environment -# variables expected by this script. -# - -############################################################################## -# Customize logstash output ip -############################################################################## -if [ "$LOGSTASH_OUTPUT" != "" ]; then - sed -i "s/elasticsearch:9200/$LOGSTASH_OUTPUT:9200/" /usr/share/logstash/pipeline/01-wazuh.conf - sed -i "s/elasticsearch:9200/$LOGSTASH_OUTPUT:9200/" /usr/share/logstash/config/logstash.yml -fi - -/usr/local/bin/docker-entrypoint