74 lines
1.8 KiB
Django/Jinja
74 lines
1.8 KiB
Django/Jinja
#jinja2: trim_blocks:False
|
|
# {{ ansible_managed }}
|
|
# Wazuh - Logstash configuration file
|
|
|
|
{% if logstash_input_beats == true %}
|
|
## Remote Wazuh Manager - Filebeat input
|
|
input {
|
|
beats {
|
|
port => 5000
|
|
codec => "json_lines"
|
|
{% if logstash_ssl == true %}
|
|
ssl => true
|
|
ssl_certificate => "{{ logstash_ssl_dir }}/{{ logstash_ssl_certificate_file | basename }}"
|
|
ssl_key => "{{ logstash_ssl_dir }}/{{ logstash_ssl_key_file | basename }}"
|
|
{% endif %}
|
|
}
|
|
}
|
|
{% else %}
|
|
## Local Wazuh Manager - JSON file input
|
|
input {
|
|
file {
|
|
type => "wazuh-alerts"
|
|
path => "/var/ossec/logs/alerts/alerts.json"
|
|
codec => "json"
|
|
}
|
|
}
|
|
{% endif %}
|
|
filter {
|
|
if [data][srcip] {
|
|
mutate {
|
|
add_field => [ "@src_ip", "%{[data][srcip]}" ]
|
|
}
|
|
}
|
|
if [data][aws][sourceIPAddress] {
|
|
mutate {
|
|
add_field => [ "@src_ip", "%{[data][aws][sourceIPAddress]}" ]
|
|
}
|
|
}
|
|
}
|
|
filter {
|
|
if [data][srcip] {
|
|
mutate {
|
|
add_field => [ "@src_ip", "%{[data][srcip]}" ]
|
|
}
|
|
}
|
|
if [data][aws][sourceIPAddress] {
|
|
mutate {
|
|
add_field => [ "@src_ip", "%{[data][aws][sourceIPAddress]}" ]
|
|
}
|
|
}
|
|
}
|
|
filter {
|
|
geoip {
|
|
source => "@src_ip"
|
|
target => "GeoLocation"
|
|
fields => ["city_name", "country_name", "region_name", "location"]
|
|
}
|
|
date {
|
|
match => ["timestamp", "ISO8601"]
|
|
target => "@timestamp"
|
|
}
|
|
mutate {
|
|
remove_field => [ "timestamp", "beat", "input_type", "tags", "count", "@version", "log", "offset", "type", "@src_ip", "host"]
|
|
}
|
|
}
|
|
output {
|
|
#stdout { codec => rubydebug }
|
|
elasticsearch {
|
|
hosts => ["{{ elasticsearch_network_host }}:{{ elasticsearch_http_port }}"]
|
|
index => "wazuh-alerts-3.x-%{+YYYY.MM.dd}"
|
|
document_type => "wazuh"
|
|
}
|
|
}
|