forked from wazuh/wazuh-docker
* Update ELK to version 5.4.2
* Update Wazuh Kibana Plugin to version 2.0_5.4.2
This commit is contained in:
+1
-1
@@ -1,4 +1,4 @@
|
||||
FROM logstash:5.3.0
|
||||
FROM logstash:5.4.2
|
||||
|
||||
RUN apt-get update
|
||||
|
||||
|
||||
@@ -13,7 +13,7 @@ input {
|
||||
#input {
|
||||
# file {
|
||||
# type => "wazuh-alerts"
|
||||
# path => "/var/ossec/data/logs/alerts/alerts.json"
|
||||
# path => "/var/ossec/logs/alerts/alerts.json"
|
||||
# codec => "json"
|
||||
# }
|
||||
#}
|
||||
@@ -21,18 +21,19 @@ filter {
|
||||
geoip {
|
||||
source => "srcip"
|
||||
target => "GeoLocation"
|
||||
fields => ["city_name", "continent_code", "country_code2", "country_name", "region_name", "location"]
|
||||
}
|
||||
date {
|
||||
match => ["timestamp", "ISO8601"]
|
||||
target => "@timestamp"
|
||||
}
|
||||
mutate {
|
||||
remove_field => [ "timestamp", "beat", "fields", "input_type", "tags", "count" ]
|
||||
remove_field => [ "timestamp", "beat", "fields", "input_type", "tags", "count", "@version", "log", "offset", "type"]
|
||||
}
|
||||
}
|
||||
output {
|
||||
elasticsearch {
|
||||
hosts => ["elasticsearch:9200"]
|
||||
hosts => ["localhost:9200"]
|
||||
index => "wazuh-alerts-%{+YYYY.MM.dd}"
|
||||
document_type => "wazuh"
|
||||
template => "/etc/logstash/wazuh-elastic5-template.json"
|
||||
|
||||
Reference in New Issue
Block a user