finetune logstash image and compose settings

docker/elk/logstash/Dockerfile

@@ -34,14 +34,15 @@ RUN apt-get update -y && \
     cd /root/dist/ && \
     cp entrypoint.sh /usr/bin/ && \
     chmod u+x /usr/bin/entrypoint.sh && \
-    mkdir -p /etc/logstash/conf.d /usr/share/logstash/config && \
-    cp logstash.conf /etc/logstash/conf.d/ && \
-    cp http_input.conf /etc/logstash/conf.d/ && \
-    cp http_output.conf /etc/logstash/conf.d/ && \
+    mkdir -p /usr/share/logstash/config && \
+    cp logstash.conf /etc/logstash/ && \
+    cp http_input.conf /etc/logstash/ && \
+    cp http_output.conf /etc/logstash/ && \
     cp pipelines.yml /usr/share/logstash/config/pipelines.yml && \
     cp pipelines_sensor.yml /usr/share/logstash/config/pipelines_sensor.yml && \
     cp tpot-template.json /etc/logstash/ && \
     rm /etc/logstash/pipelines.yml && \
+    rm /etc/logstash/logstash.yml && \
 #
 # Setup user, groups and configs
     groupmod -g 2000 logstash && \

docker/elk/logstash/dist/entrypoint.sh

@@ -82,6 +82,6 @@ if [ "$myTPOTILM" == "1" ];
       }
     }'
   else
-    echo "T-Pot ILM already configured."
+    echo "T-Pot ILM already configured or ES not available."
 fi
 echo

docker/elk/logstash/dist/http_input.conf

@@ -4,6 +4,7 @@ input {
     id => "tpot"
     host => "0.0.0.0"
     port => "64305"
+    ecs_compatibility => disabled
   }
 }
 

docker/elk/logstash/dist/pipelines.yml

@@ -1,6 +1,6 @@
 - pipeline.id: logstash
-  path.config: "/etc/logstash/conf.d/logstash.conf"
+  path.config: "/etc/logstash/logstash.conf"
   pipeline.ecs_compatibility: disabled
 - pipeline.id: http_input
-  path.config: "/etc/logstash/conf.d/http_input.conf"
+  path.config: "/etc/logstash/http_input.conf"
   pipeline.ecs_compatibility: disabled

docker/elk/logstash/dist/pipelines_sensor.yml

@@ -1,3 +1,3 @@
 - pipeline.id: http_output
-  path.config: "/etc/logstash/conf.d/http_output.conf"
+  path.config: "/etc/logstash/http_output.conf"
   pipeline.ecs_compatibility: disabled