update containers to work with filebeat

logstash/config/logstash.conf

@@ -1,22 +1,22 @@
 # Wazuh - Logstash configuration file
 ## Remote Wazuh Manager - Filebeat input
-#input {
-#    beats {
-#        port => 5000
-#        codec => "json_lines"
+input {
+    beats {
+        port => 5000
+        codec => "json_lines"
 #        ssl => true
 #        ssl_certificate => "/etc/logstash/logstash.crt"
 #        ssl_key => "/etc/logstash/logstash.key"
-#    }
-#}
-## Local Wazuh Manager - JSON file input
-input {
-   file {
-       type => "wazuh-alerts"
-       path => "/var/ossec/logs/alerts/alerts.json"
-       codec => "json"
-   }
+    }
 }
+## Local Wazuh Manager - JSON file input
+#input {
+#   file {
+#       type => "wazuh-alerts"
+#       path => "/var/ossec/data/logs/alerts/alerts.json"
+#       codec => "json"
+#   }
+#}
 filter {
     geoip {
         source => "srcip"
@@ -28,7 +28,7 @@ filter {
 }
 output {
     elasticsearch {
-        hosts => ["localhost:9200"]
+        hosts => ["elasticsearch:9200"]
         index => "wazuh-alerts-%{+YYYY.MM.dd}"
         document_type => "wazuh"
         template => "/etc/logstash/wazuh-elastic5-template.json"

logstash/config/run.sh

@@ -24,7 +24,3 @@ if [ "$1" = 'logstash' ]; then
 fi
 
 exec "$@"
-
-#echo "Wait one min to logstash restart"
-#sleep 60
-#curl -XPUT -v -H "Expect:"  "http://elasticsearch:9200/_template/ossec" -d@/etc/logstash/elastic5-ossec-template.json