From cd1e0f0aa36006b59433d2f9755a8ae08fd2773a Mon Sep 17 00:00:00 2001 From: AlfonsoRBJ Date: Thu, 24 Sep 2020 17:48:46 +0200 Subject: [PATCH] Read archives events in Filebeat (#387) --- wazuh/config/filebeat_to_logstash.yml | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/wazuh/config/filebeat_to_logstash.yml b/wazuh/config/filebeat_to_logstash.yml index 8eec470b..0e4dd97c 100644 --- a/wazuh/config/filebeat_to_logstash.yml +++ b/wazuh/config/filebeat_to_logstash.yml @@ -5,7 +5,12 @@ filebeat: inputs: - type: log paths: - - "/var/ossec/logs/alerts/alerts.json" + - "/var/ossec/logs/alerts/alerts.json" + # - type: log + # paths: + # - "/var/ossec/logs/archives/archives.json" + # fields: + # wazuh_log_file: "archives" output: logstash: