afmarulanda/wazuh-ansible-4.8.1
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Logstash role: adding the ability to switch between file and beats input

Browse Source
This commit is contained in:
Miguelangel Freitas 2017-07-13 13:25:39 -04:00
parent d59e8cd0be
commit a4c4c93369
2 changed files with 25 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
ansible-role-logstash/defaults/main.yml
View File

@ -1,4 +1,12 @@
--- ---
logstash_create_config: true
logstash_input_beats: false
elasticsearch_network_host: "127.0.0.1" elasticsearch_network_host: "127.0.0.1"
elasticsearch_http_port: "9200" elasticsearch_http_port: "9200"
elk_stack_version: 5.4.0 elk_stack_version: 5.4.0
logstash_ssl: false
logstash_ssl_dir: /etc/pki/logstash
logstash_ssl_certificate_file: ""
logstash_ssl_key_file: ""

27
ansible-role-logstash/templates/01-wazuh.conf.j2
View File

@ -1,23 +1,30 @@
# {{ ansible_managed }} # {{ ansible_managed }}
# Wazuh - Logstash configuration file # Wazuh - Logstash configuration file
{% if logstash_input_beats == true %}
## Remote Wazuh Manager - Filebeat input ## Remote Wazuh Manager - Filebeat input
input { input {
beats { beats {
port => 5000 port => 5000
codec => "json_lines" codec => "json_lines"
# ssl => true {% if logstash_ssl == true %}
# ssl_certificate => "/etc/logstash/logstash.crt" ssl => true
# ssl_key => "/etc/logstash/logstash.key" ssl_certificate => "{{ logstash_ssl_dir }}/{{ logstash_ssl_certificate_file | basename }}"
ssl_key => "{{ logstash_ssl_dir }}/{{ logstash_ssl_key_file | basename }}"
{% endif %}
} }
} }
{% else %}
## Local Wazuh Manager - JSON file input ## Local Wazuh Manager - JSON file input
#input { input {
# file { file {
# type => "wazuh-alerts" type => "wazuh-alerts"
# path => "/var/ossec/logs/alerts/alerts.json" path => "/var/ossec/logs/alerts/alerts.json"
# codec => "json" codec => "json"
# } }
#} }
{% endif %}
filter { filter {
geoip { geoip {
source => "srcip" source => "srcip"