Alex-Devera/tpotce
1
0
Fork 0
mirror of https://github.com/telekom-security/tpotce.git synced 2025-04-19 21:52:27 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

bump elk to 7.17.0 to support 8.0.1 in 22.x

Browse source
This commit is contained in:
t3chn0m4g3 2022-03-18 16:23:27 +00:00
parent cac7cdcec6
commit e2752458d4
6 changed files with 19 additions and 19 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
docker/elk/elasticsearch/Dockerfile
View file

@ -1,7 +1,7 @@
FROM alpine:3.14 FROM alpine:3.14
# #
# VARS # VARS
ENV ES_VER=7.16.2 \ ENV ES_VER=7.17.0 \
ES_JAVA_HOME=/usr/lib/jvm/java-16-openjdk ES_JAVA_HOME=/usr/lib/jvm/java-16-openjdk
# Include dist # Include dist

4
docker/elk/kibana/Dockerfile
View file

@ -1,7 +1,7 @@
FROM node:16.13.0-alpine3.14 FROM node:16.13.2-alpine3.14
# #
# VARS # VARS
ENV KB_VER=7.16.2 ENV KB_VER=7.17.0
# #
# Include dist # Include dist
ADD dist/ /root/dist/ ADD dist/ /root/dist/

12
docker/elk/logstash/Dockerfile
View file

@ -1,7 +1,7 @@
FROM alpine:3.14 FROM alpine:3.14
# #
# VARS # VARS
ENV LS_VER=7.16.2 ENV LS_VER=7.17.0
# Include dist # Include dist
ADD dist/ /root/dist/ ADD dist/ /root/dist/
# #
@ -32,11 +32,11 @@ RUN apk -U --no-cache add \
rm -rf /usr/share/logstash/jdk && \ rm -rf /usr/share/logstash/jdk && \
# For some reason Alpine 3.14 does not report the -x flag correctly and thus elasticsearch does not find java # For some reason Alpine 3.14 does not report the -x flag correctly and thus elasticsearch does not find java
sed -i 's/! -x/! -e/g' /usr/share/logstash/bin/logstash.lib.sh && \ sed -i 's/! -x/! -e/g' /usr/share/logstash/bin/logstash.lib.sh && \
/usr/share/logstash/bin/logstash-plugin install logstash-filter-translate && \ /usr/share/logstash/bin/logstash-plugin install --preserve --no-verify logstash-filter-translate && \
/usr/share/logstash/bin/logstash-plugin install logstash-input-http && \ /usr/share/logstash/bin/logstash-plugin install --preserve --no-verify logstash-input-http && \
/usr/share/logstash/bin/logstash-plugin install logstash-output-gelf && \ /usr/share/logstash/bin/logstash-plugin install --preserve --no-verify logstash-output-gelf && \
/usr/share/logstash/bin/logstash-plugin install logstash-output-http && \ /usr/share/logstash/bin/logstash-plugin install --preserve --no-verify logstash-output-http && \
/usr/share/logstash/bin/logstash-plugin install logstash-output-syslog && \ /usr/share/logstash/bin/logstash-plugin install --preserve --no-verify logstash-output-syslog && \
# #
# Add and move files # Add and move files
cd /root/dist/ && \ cd /root/dist/ && \

8
docker/elk/logstash/dist/http_output.conf vendored
View file

@ -684,12 +684,12 @@ if "_jsonparsefailure" in [tags] { drop {} }
geoip { geoip {
cache_size => 10000 cache_size => 10000
source => "src_ip" source => "src_ip"
database => "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-geoip-7.2.8-java/vendor/GeoLite2-City.mmdb" database => "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-geoip-7.2.11-java/vendor/GeoLite2-City.mmdb"
} }
geoip { geoip {
cache_size => 10000 cache_size => 10000
source => "src_ip" source => "src_ip"
database => "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-geoip-7.2.8-java/vendor/GeoLite2-ASN.mmdb" database => "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-geoip-7.2.11-java/vendor/GeoLite2-ASN.mmdb"
} }
translate { translate {
refresh_interval => 86400 refresh_interval => 86400
@ -703,13 +703,13 @@ if "_jsonparsefailure" in [tags] { drop {} }
cache_size => 10000 cache_size => 10000
source => "t-pot_ip_ext" source => "t-pot_ip_ext"
target => "geoip_ext" target => "geoip_ext"
database => "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-geoip-7.2.8-java/vendor/GeoLite2-City.mmdb" database => "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-geoip-7.2.11-java/vendor/GeoLite2-City.mmdb"
} }
geoip { geoip {
cache_size => 10000 cache_size => 10000
source => "t-pot_ip_ext" source => "t-pot_ip_ext"
target => "geoip_ext" target => "geoip_ext"
database => "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-geoip-7.2.8-java/vendor/GeoLite2-ASN.mmdb" database => "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-geoip-7.2.11-java/vendor/GeoLite2-ASN.mmdb"
} }
} }

8
docker/elk/logstash/dist/logstash.conf vendored
View file

@ -684,12 +684,12 @@ if "_jsonparsefailure" in [tags] { drop {} }
geoip { geoip {
cache_size => 10000 cache_size => 10000
source => "src_ip" source => "src_ip"
database => "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-geoip-7.2.8-java/vendor/GeoLite2-City.mmdb" database => "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-geoip-7.2.11-java/vendor/GeoLite2-City.mmdb"
} }
geoip { geoip {
cache_size => 10000 cache_size => 10000
source => "src_ip" source => "src_ip"
database => "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-geoip-7.2.8-java/vendor/GeoLite2-ASN.mmdb" database => "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-geoip-7.2.11-java/vendor/GeoLite2-ASN.mmdb"
} }
translate { translate {
refresh_interval => 86400 refresh_interval => 86400
@ -703,13 +703,13 @@ if "_jsonparsefailure" in [tags] { drop {} }
cache_size => 10000 cache_size => 10000
source => "t-pot_ip_ext" source => "t-pot_ip_ext"
target => "geoip_ext" target => "geoip_ext"
database => "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-geoip-7.2.8-java/vendor/GeoLite2-City.mmdb" database => "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-geoip-7.2.11-java/vendor/GeoLite2-City.mmdb"
} }
geoip { geoip {
cache_size => 10000 cache_size => 10000
source => "t-pot_ip_ext" source => "t-pot_ip_ext"
target => "geoip_ext" target => "geoip_ext"
database => "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-geoip-7.2.8-java/vendor/GeoLite2-ASN.mmdb" database => "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-geoip-7.2.11-java/vendor/GeoLite2-ASN.mmdb"
} }
} }

4
docker/elk/logstash/docker-compose.yml
View file

@ -7,8 +7,8 @@ services:
build: . build: .
container_name: logstash container_name: logstash
restart: always restart: always
environment: # environment:
- LS_JAVA_OPTS=-Xms2048m -Xmx2048m # - LS_JAVA_OPTS=-Xms2048m -Xmx2048m
# depends_on: # depends_on:
# elasticsearch: # elasticsearch:
# condition: service_healthy # condition: service_healthy