In the case of a distributed deployment (master server with separate storage nodes), the master server should be running conf.d.redis.output and that already has 0006_input_beats.conf. Storage nodes would need the parsing and output.
Permanent Fix
We should create an Elasticsearch ingest version of 6600_winlogbeat_sysmon.conf and 6700_winlogbeat.conf. The LOGSTASH_MINIMAL section of so-logstash-start could then include 0006_input_beats.conf and 9500_output_beats.conf and remove 6600_winlogbeat_sysmon.conf and 6700_winlogbeat.conf if necessary.
Reference https://groups.google.com/d/topic/security-onion/5EuT6KpJ-6c/discussion
Problem We recently changed Setup so that new Production Mode deployments are set to LOGSTASH_MINIMAL by default (https://github.com/Security-Onion-Solutions/security-onion/issues/1732). LOGSTASH_MINIMAL is a minimal Logstash config that does not include Beat config.
Quick Fix A standalone box (Production Mode, New Deployment, store logs locally without storage nodes) would need input, parsing, and output:
In the case of a distributed deployment (master server with separate storage nodes), the master server should be running
conf.d.redis.output
and that already has0006_input_beats.conf
. Storage nodes would need the parsing and output.Permanent Fix We should create an Elasticsearch ingest version of
6600_winlogbeat_sysmon.conf
and6700_winlogbeat.conf
. TheLOGSTASH_MINIMAL
section ofso-logstash-start
could then include0006_input_beats.conf
and9500_output_beats.conf
and remove6600_winlogbeat_sysmon.conf
and6700_winlogbeat.conf
if necessary.