From e6e30ab3aaa866e9886cfe1596ccdf54aed3839f Mon Sep 17 00:00:00 2001
From: Jose Luis Ruiz <jose@wazuh.com>
Date: Wed, 21 Jun 2017 12:15:48 +0200
Subject: [PATCH] * Update ELK to version 5.4.2 * Update Wazuh Kibana Plugin to
 version 2.0_5.4.2

---
 README.md                     | 2 +-
 docker-compose.yml            | 2 +-
 kibana/Dockerfile             | 2 +-
 logstash/Dockerfile           | 2 +-
 logstash/config/logstash.conf | 7 ++++---
 wazuh/Dockerfile              | 4 ++--
 6 files changed, 10 insertions(+), 9 deletions(-)

diff --git a/README.md b/README.md
index 714f4ce4..5d54379a 100644
--- a/README.md
+++ b/README.md
@@ -2,7 +2,7 @@
 
 The first time than you runt this container can take a while until kibana finish the configuration, the Wazuh plugin can take a few minutes until finish the instalation, please be patient.
 
-# Docker container Wazuh + ELK(5.3.0)
+# Docker container Wazuh 2.0 + ELK(5.4.2)
 
 This Docker container source files can be found in our [Wazuh Github repository](https://github.com/wazuh/wazuh). It includes both an OSSEC manager and an Elasticsearch single-node cluster, with Logstash and Kibana. You can find more information on how these components work together in our documentation.
 
diff --git a/docker-compose.yml b/docker-compose.yml
index 0cff2c9a..15bb2936 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -36,7 +36,7 @@ services:
     environment:
       - LS_HEAP_SIZE=2048m
   elasticsearch:
-    image: elasticsearch:5.3.0
+    image: elasticsearch:5.4.2
     hostname: elasticsearch
     restart: always
     command: elasticsearch -E node.name="node-1" -E cluster.name="wazuh" -E network.host=0.0.0.0
diff --git a/kibana/Dockerfile b/kibana/Dockerfile
index 412dd99d..12a4d6dc 100644
--- a/kibana/Dockerfile
+++ b/kibana/Dockerfile
@@ -1,4 +1,4 @@
-FROM kibana:5.3.0
+FROM kibana:5.4.2
 
 RUN apt-get update && apt-get install -y curl
 
diff --git a/logstash/Dockerfile b/logstash/Dockerfile
index e7b9417e..9e9d1de4 100644
--- a/logstash/Dockerfile
+++ b/logstash/Dockerfile
@@ -1,4 +1,4 @@
-FROM logstash:5.3.0
+FROM logstash:5.4.2
 
 RUN apt-get update
 
diff --git a/logstash/config/logstash.conf b/logstash/config/logstash.conf
index b9eafcfc..e9a7c14d 100644
--- a/logstash/config/logstash.conf
+++ b/logstash/config/logstash.conf
@@ -13,7 +13,7 @@ input {
 #input {
 #   file {
 #       type => "wazuh-alerts"
-#       path => "/var/ossec/data/logs/alerts/alerts.json"
+#       path => "/var/ossec/logs/alerts/alerts.json"
 #       codec => "json"
 #   }
 #}
@@ -21,18 +21,19 @@ filter {
     geoip {
         source => "srcip"
         target => "GeoLocation"
+        fields => ["city_name", "continent_code", "country_code2", "country_name", "region_name", "location"]
     }
     date {
         match => ["timestamp", "ISO8601"]
         target => "@timestamp"
     }
     mutate {
-        remove_field => [ "timestamp", "beat", "fields", "input_type", "tags", "count" ]
+        remove_field => [ "timestamp", "beat", "fields", "input_type", "tags", "count", "@version", "log", "offset", "type"]
     }
 }
 output {
     elasticsearch {
-        hosts => ["elasticsearch:9200"]
+        hosts => ["localhost:9200"]
         index => "wazuh-alerts-%{+YYYY.MM.dd}"
         document_type => "wazuh"
         template => "/etc/logstash/wazuh-elastic5-template.json"
diff --git a/wazuh/Dockerfile b/wazuh/Dockerfile
index 1173f6fd..374a9bd5 100644
--- a/wazuh/Dockerfile
+++ b/wazuh/Dockerfile
@@ -18,8 +18,8 @@ RUN chmod 755 /init.bash &&\
   sync && rm /init.bash
 
 
-RUN  curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-5.1.2-x86_64.rpm &&\
-  rpm -vi filebeat-5.1.2-x86_64.rpm && rm filebeat-5.1.2-x86_64.rpm
+RUN  curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-5.4.2-x86_64.rpm &&\
+  rpm -vi filebeat-5.4.2-x86_64.rpm && rm filebeat-5.4.2-x86_64.rpm
 
 COPY config/filebeat.yml /etc/filebeat/