* Update ELK to version 5.4.2

* Update Wazuh Kibana Plugin to version 2.0_5.4.2
This commit is contained in:
Jose Luis Ruiz
2017-06-21 12:15:48 +02:00
parent 754915cb35
commit e6e30ab3aa
6 changed files with 10 additions and 9 deletions
+1 -1
View File
@@ -1,4 +1,4 @@
FROM logstash:5.3.0
FROM logstash:5.4.2
RUN apt-get update
+4 -3
View File
@@ -13,7 +13,7 @@ input {
#input {
# file {
# type => "wazuh-alerts"
# path => "/var/ossec/data/logs/alerts/alerts.json"
# path => "/var/ossec/logs/alerts/alerts.json"
# codec => "json"
# }
#}
@@ -21,18 +21,19 @@ filter {
geoip {
source => "srcip"
target => "GeoLocation"
fields => ["city_name", "continent_code", "country_code2", "country_name", "region_name", "location"]
}
date {
match => ["timestamp", "ISO8601"]
target => "@timestamp"
}
mutate {
remove_field => [ "timestamp", "beat", "fields", "input_type", "tags", "count" ]
remove_field => [ "timestamp", "beat", "fields", "input_type", "tags", "count", "@version", "log", "offset", "type"]
}
}
output {
elasticsearch {
hosts => ["elasticsearch:9200"]
hosts => ["localhost:9200"]
index => "wazuh-alerts-%{+YYYY.MM.dd}"
document_type => "wazuh"
template => "/etc/logstash/wazuh-elastic5-template.json"