update containers to work with filebeat

wazuh/config/default_agent

@@ -1 +0,0 @@
-127.0.0.1,DEFAULT_LOCAL_AGENT

wazuh/config/filebeat.yml

@@ -0,0 +1,16 @@
+filebeat:
+ prospectors:
+  - input_type: log
+    paths:
+     - "/var/ossec/data/logs/alerts/alerts.json"
+    document_type: wazuh-alerts
+    json.message_key: log
+    json.keys_under_root: true
+    json.overwrite_keys: true
+
+output:
+ logstash:
+   # The Logstash hosts
+   hosts: ["logstash:5000"]
+#   ssl:
+#     certificate_authorities: ["/etc/filebeat/logstash.crt"]

wazuh/config/run.sh

@@ -100,6 +100,7 @@ LAST_OK_DATE=`date +%s`
 #cd /var/ossec/update/ruleset && python ossec_ruleset.py
 
 /bin/node /var/ossec/api/app.js &
+/usr/bin/filebeat.sh &
 /var/ossec/bin/ossec-control restart