update containers to work with filebeat

wazuh/Dockerfile

@@ -16,6 +16,11 @@ RUN chmod 755 /init.bash &&\
   sync && rm /init.bash
 
 
+RUN  curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-5.1.2-x86_64.rpm &&\
+  rpm -vi filebeat-5.1.2-x86_64.rpm && rm filebeat-5.1.2-x86_64.rpm
+
+COPY config/filebeat.yml /etc/filebeat/
+
 ADD config/run.sh /tmp/run.sh
 RUN chmod 755 /tmp/run.sh
 

wazuh/config/default_agent

@@ -1 +0,0 @@
-127.0.0.1,DEFAULT_LOCAL_AGENT

wazuh/config/filebeat.yml

@@ -0,0 +1,16 @@
+filebeat:
+ prospectors:
+  - input_type: log
+    paths:
+     - "/var/ossec/data/logs/alerts/alerts.json"
+    document_type: wazuh-alerts
+    json.message_key: log
+    json.keys_under_root: true
+    json.overwrite_keys: true
+
+output:
+ logstash:
+   # The Logstash hosts
+   hosts: ["logstash:5000"]
+#   ssl:
+#     certificate_authorities: ["/etc/filebeat/logstash.crt"]

wazuh/config/run.sh

@@ -100,6 +100,7 @@ LAST_OK_DATE=`date +%s`
 #cd /var/ossec/update/ruleset && python ossec_ruleset.py
 
 /bin/node /var/ossec/api/app.js &
+/usr/bin/filebeat.sh &
 /var/ossec/bin/ossec-control restart