telekom-security/tpotce
1
0
Fork 0
mirror of https://github.com/telekom-security/tpotce.git synced 2025-07-02 01:27:27 -04:00
Code Issues Packages Projects Releases Wiki Activity

Bump Elastic Stack to 8.18.3

Browse Source 
- Logstash: include syslog output plugin and config example
This commit is contained in:
t3chn0m4g3
2025-06-30 16:06:45 +02:00
parent 6933ee0065
commit 175e1944c2
6 changed files with 27 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
docker/elk/logstash/Dockerfile
View File

@ -1,6 +1,6 @@
FROM ubuntu:24.04
ENV DEBIAN_FRONTEND=noninteractive
ENV LS_VER=8.18.2
ENV LS_VER=8.18.3
#
# Include dist
COPY dist/ /root/dist/
@ -42,6 +42,7 @@ RUN apt-get update -y && \
cp tpot-template.json /etc/logstash/ && \
cd /usr/share/logstash && \
bin/logstash-plugin update logstash-filter-translate && \
bin/logstash-plugin install logstash-output-syslog && \
rm /etc/logstash/pipelines.yml && \
rm /etc/logstash/logstash.yml && \
#

9
docker/elk/logstash/dist/http_input.conf vendored
View File

@ -17,5 +17,12 @@ output {
template => "/etc/logstash/tpot-template.json"
template_overwrite => "true"
}
# Syslog Output Example
# syslog {
# host => "192.168.1.1"
# port => 514
# protocol => tcp
# appname => "logstash-logs"
# severity => "6"
# }
}

9
docker/elk/logstash/dist/logstash.conf vendored
View File

@ -816,7 +816,14 @@ output {
template => "/etc/logstash/tpot-template.json"
template_overwrite => "true"
}
# Syslog Output Example
# syslog {
# host => "192.168.1.1"
# port => 514
# protocol => tcp
# appname => "logstash-logs"
# severity => "6"
# }
#if [type] == "Suricata" {
# file {
# file_mode => 0770