tpotce/docker/elk/elasticsearch/dist/elasticsearch.yml

cluster.name: tpotcluster
node.name: "tpotcluster-node-01"
xpack.ml.enabled: false
xpack.security.enabled: false
path:
    logs: /data/elk/log
    data: /data/elk/data
http.host: 0.0.0.0
http.cors.enabled: true
http.cors.allow-origin: "*"
indices.query.bool.max_clause_count: 2000
cluster.routing.allocation.disk.watermark.enable_for_single_data_node: true
discovery.type: single-node
include docker repos ... skip emobility since it is a dev repo 2017-10-13 18:58:14 +00:00			`cluster.name: tpotcluster`
			`node.name: "tpotcluster-node-01"`
Bump ELK Stack to 6.3.0 2018-06-26 17:34:14 +00:00			`xpack.ml.enabled: false`
elk 7.x dev test 2020-01-31 14:21:55 +00:00			`xpack.security.enabled: false`
include docker repos ... skip emobility since it is a dev repo 2017-10-13 18:58:14 +00:00			`path:`
			`logs: /data/elk/log`
			`data: /data/elk/data`
			`http.host: 0.0.0.0`
			`http.cors.enabled: true`
			`http.cors.allow-origin: "*"`
tweaking ELK 7.6.0 is not ready for production, however it works if APM is enabled (disabled in config, so image wont build as precaution) Remove SISSDEN from ewsposter, suricata Bump suricata to 5.0.1 Alpine now support suricata incl. enabled JA3 support, move back to Alpine install 2020-02-14 15:28:06 +00:00			`indices.query.bool.max_clause_count: 2000`
prep for elk 8.x, pave way for next t-pot release 2022-01-07 18:03:00 +00:00			`cluster.routing.allocation.disk.watermark.enable_for_single_data_node: true`
			`discovery.type: single-node`