From 8a6225856d5b0791bc1f17a935d0e6daeb2a916d Mon Sep 17 00:00:00 2001
From: manuasir <manuel.jimenez@wazuh.com>
Date: Tue, 18 Jun 2019 18:56:41 +0200
Subject: [PATCH] Change Elasticsearch output in Filebeat if env var was set

---
 wazuh/Dockerfile                   |  9 +++++----
 wazuh/config/01-config_filebeat.sh | 10 ++++++++++
 2 files changed, 15 insertions(+), 4 deletions(-)
 create mode 100644 wazuh/config/01-config_filebeat.sh

diff --git a/wazuh/Dockerfile b/wazuh/Dockerfile
index 4f3849a0..e4a2814c 100644
--- a/wazuh/Dockerfile
+++ b/wazuh/Dockerfile
@@ -32,6 +32,7 @@ COPY config/init.bash /init.bash
 RUN mkdir /entrypoint-scripts
 COPY config/entrypoint.sh /entrypoint.sh
 COPY config/00-wazuh.sh /entrypoint-scripts/00-wazuh.sh
+COPY config/01-config_filebeat.sh /entrypoint-scripts/01-config_filebeat.sh
 
 # Sync calls are due to https://github.com/docker/docker/issues/9547
 RUN chmod 755 /init.bash && \
@@ -40,10 +41,11 @@ RUN chmod 755 /init.bash && \
    curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-${FILEBEAT_VERSION}-amd64.deb &&\
    dpkg -i filebeat-${FILEBEAT_VERSION}-amd64.deb && rm -f filebeat-${FILEBEAT_VERSION}-amd64.deb && \
    chmod 755 /entrypoint.sh && \
-   chmod 755 /entrypoint-scripts/00-wazuh.sh 
+   chmod 755 /entrypoint-scripts/00-wazuh.sh && \
+   chmod 755 /entrypoint-scripts/01-config_filebeat.sh
 
 COPY config/filebeat.yml /etc/filebeat/
-RUN chmod go-w /etc/filebeat/filebeat.yml 
+RUN chmod go-w /etc/filebeat/filebeat.yml
 
 # Setting volumes
 VOLUME ["/var/ossec/data"]
@@ -75,5 +77,4 @@ ADD https://raw.githubusercontent.com/wazuh/wazuh/$TEMPLATE_VERSION/extensions/e
 RUN chmod go-w /etc/filebeat/wazuh-template.json 
 
 # Run all services
-ENTRYPOINT ["/entrypoint.sh"]
-
+ENTRYPOINT ["/entrypoint.sh"]
\ No newline at end of file
diff --git a/wazuh/config/01-config_filebeat.sh b/wazuh/config/01-config_filebeat.sh
new file mode 100644
index 00000000..61cd1c2a
--- /dev/null
+++ b/wazuh/config/01-config_filebeat.sh
@@ -0,0 +1,10 @@
+#!/bin/bash
+# Wazuh App Copyright (C) 2019 Wazuh Inc. (License GPLv2)
+
+set -e
+
+# Modify the output to Elasticsearch if th ELASTICSEARCH_URL is set
+if [ "$ELASTICSEARCH_URL" != "" ]; then
+  >&2 echo "Customize Elasticsearch ouput IP."
+  sed -i 's|http://elasticsearch:9200|'$ELASTICSEARCH_URL'|g' /etc/filebeat/filebeat.yml
+fi
\ No newline at end of file