Cyb3rWard0g / HELK

The Hunting ELK
GNU General Public License v3.0
3.75k stars 680 forks source link

Add patterns folder and custom-pattern-example file to helk-logstash … #510

Closed colinrubbert closed 3 years ago

colinrubbert commented 3 years ago

…pipeline folder for easier customization and extensibility of the HELK stack.

What is this PR for? Adding a patterns folder to the helk-logstash pipeline to allow for custom patterns for pipeline/*.conf files that do not already have a pattern shipped by default with logstash.

Adding this to the pipeline folder eliminates the need to edit any other part of the HELK stack reducing the obfuscation and complication of customizing docker containers while providing an ability for people to further enhance HELK to their desired needs.

What type of PR is it? [Feature Request]

How should this be tested? This can be tested with a custom .conf file in the pipeline folder using a custom pattern variable that is not provided by logstash out of the box. I can provide a custom .conf file and custom pattern file. My plan will be to add documentation to provide a use-case example using pi-hole logs, pi-hole custom .conf, and dns-pihole custom pattern file.

Questions:

Cyb3rWard0g commented 3 years ago

Thank you very much @colinrubbert ! I really appreciate it !