From 02e69fc3bcdb4fcde2d75d1eccb03cbb7528d38c Mon Sep 17 00:00:00 2001
From: thomashaw <thomashaw@gmail.com>
Date: Tue, 8 Dec 2020 17:48:28 +0000
Subject: [PATCH] wip

---
 scenarios/examples/elkstack_7.xml | 36 +++++++++++++++----------------
 1 file changed, 17 insertions(+), 19 deletions(-)

diff --git a/scenarios/examples/elkstack_7.xml b/scenarios/examples/elkstack_7.xml
index f2490efa3..008254448 100644
--- a/scenarios/examples/elkstack_7.xml
+++ b/scenarios/examples/elkstack_7.xml
@@ -69,27 +69,25 @@
 			</input>
 		</service>
 
-<!--		<utility module_path=".*/filebeat.*">-->
-<!--			<input into="logstash_ip">-->
-<!--				<datastore access="0">IP_address</datastore>-->
-<!--			</input>-->
-<!--			<input into="logstash_port">-->
-<!--				<datastore access="0">logstash_port</datastore>-->
-<!--			</input>-->
-<!--		</utility>-->
+		<utility module_path=".*/filebeat.*">
+			<input into="logstash_ip">
+				<datastore access="0">IP_addresses</datastore>
+			</input>
+			<input into="logstash_port">
+				<datastore access="0">logstash_port</datastore>
+			</input>
+		</utility>
 
-<!--		<utility module_path=".*/auditbeat.*">-->
-<!--			<input into="logstash_ip">-->
-<!--				<datastore access="0">IP_address</datastore>-->
-<!--			</input>-->
-<!--			<input into="logstash_port">-->
-<!--				<datastore access="0">logstash_port</datastore>-->
-<!--			</input>-->
-<!--		</utility>-->
+		<utility module_path=".*/auditbeat.*">
+			<input into="logstash_ip">
+				<datastore access="0">IP_addresses</datastore>
+			</input>
+			<input into="logstash_port">
+				<datastore access="0">logstash_port</datastore>
+			</input>
+		</utility>
 
-<!--		<utility module_path=".*/elastalert.*">-->
-
-<!--		</utility>-->
+<!--	TODO: Update this to use latest elastalert version	<utility module_path=".*/elastalert.*"/>-->
 
 		<network type="private_network" >
 			<input into="IP_address">