mirror of
https://github.com/telekom-security/tpotce.git
synced 2025-07-02 01:27:27 -04:00
bump ELK to 6.4.0
YES! Index patterns can finally exported through Kibana! A joy to the ELK world :-)
This commit is contained in:
@ -17,9 +17,9 @@ RUN apk -U --no-cache add \
|
||||
git clone --depth=1 https://github.com/dtag-dev-sec/listbot /etc/listbot && \
|
||||
cd /root/dist/ && \
|
||||
mkdir -p /usr/share/logstash/ && \
|
||||
wget https://artifacts.elastic.co/downloads/logstash/logstash-6.3.2.tar.gz && \
|
||||
wget https://artifacts.elastic.co/downloads/logstash/logstash-6.4.0.tar.gz && \
|
||||
wget http://geolite.maxmind.com/download/geoip/database/GeoLite2-ASN.tar.gz && \
|
||||
tar xvfz logstash-6.3.2.tar.gz --strip-components=1 -C /usr/share/logstash/ && \
|
||||
tar xvfz logstash-6.4.0.tar.gz --strip-components=1 -C /usr/share/logstash/ && \
|
||||
/usr/share/logstash/bin/logstash-plugin install logstash-filter-translate && \
|
||||
/usr/share/logstash/bin/logstash-plugin install logstash-output-syslog && \
|
||||
tar xvfz GeoLite2-ASN.tar.gz --strip-components=1 -C /usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-filter-geoip-5.0.3-java/vendor/ && \
|
||||
|
2
docker/elk/logstash/dist/logstash.conf
vendored
2
docker/elk/logstash/dist/logstash.conf
vendored
@ -394,7 +394,7 @@ if "_grokparsefailure" in [tags] { drop {} }
|
||||
output {
|
||||
elasticsearch {
|
||||
hosts => ["elasticsearch:9200"]
|
||||
document_type => "doc"
|
||||
# document_type => "doc"
|
||||
}
|
||||
|
||||
if [type] == "Suricata" {
|
||||
|
Reference in New Issue
Block a user