Update Elastic templates. Logstash conf. Disabled updateruleset

2016-12-19 17:45:57 +01:00
parent 64e6c4743d
commit e2c4882fc2
5 changed files with 154 additions and 133 deletions
@@ -1,43 +1,35 @@
+# Wazuh - Logstash configuration file
+## Remote Wazuh Manager - Filebeat input
+#input {
+#    beats {
+#        port => 5000
+#        codec => "json_lines"
+#    }
+#}
+## Local Wazuh Manager - JSON file input
 input {
-  file {
-    type => "ossec-alerts"
-    path => "/var/ossec/data/logs/alerts/alerts.json"
-    codec => "json"
+   file {
+       type => "wazuh-alerts"
+       path => "/var/ossec/logs/alerts/alerts.json"
+       codec => "json"
+   }
+}
+filter {
+    geoip {
+        source => "srcip"
+        target => "GeoLocation"
+    }
+    mutate {
+        remove_field => [ "timestamp", "beat", "fields", "input_type", "tags", "count" ]
    }
 }
-
-filter {
-        geoip {
-                source => "srcip"
-                target => "GeoLocation"
-        }
-        if [SyscheckFile][path] {
-                mutate {
-                        add_field => {"file" => "%{[SyscheckFile][path]}"}
-                }
-        }
-        grok {
-                match=> {
-                        "file" => ["^/.+/(?<audit_file>(.+)$)|^[A-Z]:.+\\(?<audit_file>(.+)$)|^[A-Z]:\\.+/(?<audit_file>(.+)$)"]
-                }
-        }
-        mutate {
-                rename => [ "hostname", "AgentName" ]
-                rename => [ "agentip", "AgentIP" ]
-                rename => [ "[rule][comment]", "[rule][description]" ]
-                rename => [ "[rule][level]", "[rule][AlertLevel]" ]
-                remove_field => [ "timestamp", "beat", "fields", "input_type", "tags", "count" ]
-        }
-}
-
 output {
-        #stdout { codec => rubydebug }
-        elasticsearch {
-                 hosts => ["elasticsearch:9200"]
-                 index => "ossec-%{+YYYY.MM.dd}"
-                 document_type => "ossec"
-                 template => "/etc/logstash/elastic5-ossec-template.json"
-                 template_name => "ossec"
-                 template_overwrite => true
-        }
-}
+    elasticsearch {
+        hosts => ["elasticsearch:9200"]
+        index => "wazuh-alerts-%{+YYYY.MM.dd}"
+        document_type => "wazuh"
+        template => "/etc/logstash/wazuh-elastic5-template.json"
+        template_name => "wazuh"
+        template_overwrite => true
+    }
+}