diff --git a/modules/utilities/unix/logging/elasticsearch/elasticsearch.pp b/modules/utilities/unix/logging/elasticsearch/elasticsearch.pp
index 70dc1c305..482ffa5d2 100644
--- a/modules/utilities/unix/logging/elasticsearch/elasticsearch.pp
+++ b/modules/utilities/unix/logging/elasticsearch/elasticsearch.pp
@@ -1,8 +1,18 @@
$secgen_parameters = secgen_functions::get_parameters($::base64_inputs_file)
-$ip_address = $secgen_parameters['IP_address'][0] # TODO: Which IP address? how do we do this with two servers?
+$elasticsearch_ip = $secgen_parameters['elasticsearch_ip'][0]
+$elasticsearch_port = 0 + $secgen_parameters['elasticsearch_port'][0]
include ::java
-class { 'elasticsearch': }
-elasticsearch::instance { 'es-01': }
+class { 'elasticsearch':
+ api_host => $elasticsearch_ip,
+ api_port => $elasticsearch_port,
+}
+
+elasticsearch::instance { 'es-01':
+ config => {
+ 'network.host' => $elasticsearch_ip,
+ 'http.port' => $elasticsearch_port,
+ },
+}
diff --git a/modules/utilities/unix/logging/elasticsearch/secgen_metadata.xml b/modules/utilities/unix/logging/elasticsearch/secgen_metadata.xml
index f98e59e53..24657b5f0 100644
--- a/modules/utilities/unix/logging/elasticsearch/secgen_metadata.xml
+++ b/modules/utilities/unix/logging/elasticsearch/secgen_metadata.xml
@@ -12,6 +12,17 @@
log_tool
linux
+ elasticsearch_ip
+ elasticsearch_port
+
+
+ localhost
+
+
+
+ 9200
+
+
update
diff --git a/modules/utilities/unix/logging/filebeat/filebeat.pp b/modules/utilities/unix/logging/filebeat/filebeat.pp
index b29060ec6..6fb36cf13 100644
--- a/modules/utilities/unix/logging/filebeat/filebeat.pp
+++ b/modules/utilities/unix/logging/filebeat/filebeat.pp
@@ -1 +1,22 @@
-include filebeat::setup
\ No newline at end of file
+$secgen_parameters = secgen_functions::get_parameters($::base64_inputs_file)
+$logstash_ip = $secgen_parameters['logstash_ip'][0]
+$logstash_port = 0 + $secgen_parameters['logstash_port'][0]
+
+class { 'filebeat':
+ outputs => {
+ 'logstash' => {
+ 'hosts' => [
+ "$logstash_ip:$logstash_port",
+ ],
+ 'index' => 'filebeat',
+ },
+ },
+}
+
+filebeat::prospector { 'syslogs':
+ paths => [
+ '/var/log/auth.log',
+ '/var/log/syslog',
+ ],
+ doc_type => 'syslog-beat',
+}
\ No newline at end of file
diff --git a/modules/utilities/unix/logging/filebeat/manifests/setup.pp b/modules/utilities/unix/logging/filebeat/manifests/setup.pp
deleted file mode 100644
index 75aa225dc..000000000
--- a/modules/utilities/unix/logging/filebeat/manifests/setup.pp
+++ /dev/null
@@ -1,25 +0,0 @@
-class filebeat::setup {
-
- $secgen_parameters = secgen_functions::get_parameters($::base64_inputs_file)
- $ip_address = $secgen_parameters['IP_address'][0] # TODO: Which IP address? how do we do this with two servers?
-
-
- class { 'filebeat':
- outputs => {
- 'logstash' => {
- 'hosts' => [
- "$ip_address:5043",
- ],
- 'index' => 'filebeat',
- },
- },
- }
-
- filebeat::prospector { 'syslogs':
- paths => [
- '/var/log/auth.log',
- '/var/log/syslog',
- ],
- doc_type => 'syslog-beat',
- }
-}
\ No newline at end of file
diff --git a/modules/utilities/unix/logging/filebeat/secgen_metadata.xml b/modules/utilities/unix/logging/filebeat/secgen_metadata.xml
index 13e6e2d53..bf26b0ad6 100644
--- a/modules/utilities/unix/logging/filebeat/secgen_metadata.xml
+++ b/modules/utilities/unix/logging/filebeat/secgen_metadata.xml
@@ -12,6 +12,17 @@
log_tool
linux
+ logstash_ip
+ logstash_port
+
+
+ localhost
+
+
+
+ 5044
+
+
update
diff --git a/modules/utilities/unix/logging/kibana/kibana.pp b/modules/utilities/unix/logging/kibana/kibana.pp
index fc7911b9c..bf02c29cf 100644
--- a/modules/utilities/unix/logging/kibana/kibana.pp
+++ b/modules/utilities/unix/logging/kibana/kibana.pp
@@ -1,11 +1,15 @@
$secgen_parameters = secgen_functions::get_parameters($::base64_inputs_file)
-$ip_address = $secgen_parameters['IP_address'][0] # TODO: Which IP address? how do we do this with two servers?
+
+$kibana_ip = $secgen_parameters['kibana_ip'][0]
+$kibana_port = 0 + $secgen_parameters['kibana_port'][0]
+
+$elasticsearch_ip = $secgen_parameters['elasticsearch_ip'][0] # TODO: Which IP address? how do we do this with two servers?
+$elasticsearch_port = 0 + $secgen_parameters['elasticsearch_port'][0] # TODO: Which IP address? how do we do this with two servers?
class { 'kibana':
config => {
- 'server.host' => $ip_address,
- 'elasticsearch.url' => "http://$ip_address:9200",
- 'server.port' => '5601',
+ 'server.host' => $kibana_ip,
+ 'elasticsearch.url' => "http://$elasticsearch_ip:$elasticsearch_port",
+ 'server.port' => $kibana_port,
}
-}
-
+}
\ No newline at end of file
diff --git a/modules/utilities/unix/logging/kibana/secgen_metadata.xml b/modules/utilities/unix/logging/kibana/secgen_metadata.xml
index 509ffa190..c573862a7 100644
--- a/modules/utilities/unix/logging/kibana/secgen_metadata.xml
+++ b/modules/utilities/unix/logging/kibana/secgen_metadata.xml
@@ -12,6 +12,27 @@
log_tool
linux
+ kibana_ip
+ kibana_port
+ elasticsearch_ip
+ elasticsearch_port
+
+
+ localhost
+
+
+
+ 5601
+
+
+
+ localhost
+
+
+
+ 9200
+
+
update
diff --git a/modules/utilities/unix/logging/logstash/logstash.pp b/modules/utilities/unix/logging/logstash/logstash.pp
index 48cd7544c..78cfc41c6 100644
--- a/modules/utilities/unix/logging/logstash/logstash.pp
+++ b/modules/utilities/unix/logging/logstash/logstash.pp
@@ -1,21 +1,31 @@
$secgen_parameters = secgen_functions::get_parameters($::base64_inputs_file)
-$ip_address = $secgen_parameters['ip_address'][0] # TODO: Which IP address? how do we do this with two servers?
+$logstash_port = 0 + $secgen_parameters['logstash_port'][0]
+$elasticsearch_ip = $secgen_parameters['elasticsearch_ip'][0]
+$elasticsearch_port = 0 + $secgen_parameters['elasticsearch_port'][0]
-class { 'logstash':
- settings => {
- 'http.host' => $ip_address,
- }
+include logstash
+
+# You must provide a valid pipeline configuration for the service to start.
+logstash::configfile { 'my_ls_config':
+ content => template('logstash/configfile-template.erb'),
}
-logstash::plugin { 'logstash-input-beats': }
-# TODO : Find out what this does. It's likely a .conf file template, not sure why hes using this @(""/L) | "" instead of an erb
-# TODO : ... unless it's just for the sake of the demonstration.
+# TODO: Delete this if its a problem
+#
+# class { 'logstash':
+# settings => {
+# 'http.host' => $ip_address,
+# }
+# }
+
+# logstash::plugin { 'logstash-input-beats': }
+
# $myconfig = @("MYCONFIG"/L)
# input {
# beats {
-# port => 5043
+# port => 5044
# }
# }
# output {
diff --git a/modules/utilities/unix/logging/logstash/secgen_metadata.xml b/modules/utilities/unix/logging/logstash/secgen_metadata.xml
index 485f542fb..649a2a4f8 100644
--- a/modules/utilities/unix/logging/logstash/secgen_metadata.xml
+++ b/modules/utilities/unix/logging/logstash/secgen_metadata.xml
@@ -12,6 +12,22 @@
log_tool
linux
+ logstash_port
+ elasticsearch_ip
+ elasticsearch_port
+
+
+ 5044
+
+
+
+ localhost
+
+
+
+ 9200
+
+
update
diff --git a/modules/utilities/unix/logging/logstash/templates/configfile-template.erb b/modules/utilities/unix/logging/logstash/templates/configfile-template.erb
index 47b606513..df430a635 100644
--- a/modules/utilities/unix/logging/logstash/templates/configfile-template.erb
+++ b/modules/utilities/unix/logging/logstash/templates/configfile-template.erb
@@ -1 +1,14 @@
-# 2 + 2 equals <%= 2+2 -%>
+input {
+ beats {
+ port => <%= @logstash_port-%>
+ }
+}
+output {
+ elasticsearch {
+ hosts => "<%= @elasticsearch_ip-%>:<%= @elasticsearch_port-%>"
+ manage_template => false
+ index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
+ document_type => "%{[@metadata][type]}"
+ }
+ stdout { codec => rubydebug }
+}
\ No newline at end of file
diff --git a/scenarios/examples/elkstack.xml b/scenarios/examples/elkstack.xml
index d7adbc77d..a0e946b1d 100644
--- a/scenarios/examples/elkstack.xml
+++ b/scenarios/examples/elkstack.xml
@@ -6,42 +6,100 @@
escalation
-
-
+
172.16.0.2
+
+ 9200
+
+
+
+ 5044
+
+
+
+ 5601
+
+
-
- logstash_ip
+
+ IP_address
+
+
+ elasticsearch_port
-
-
-
-
-
-
-
-
-
-
-
+
+
+ logstash_port
+
+
+ IP_address
+
+
+ elasticsearch_port
+
+
+
+
+
+ IP_address
+
+
+ kibana_port
+
+
+ IP_address
+
+
+ elasticsearch_port
+
+
+
+
+
+ IP_address
+
+
+ logstash_port
+
+
- logstash_ip
+ IP_address
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+