-
Notifications
You must be signed in to change notification settings - Fork 375
/
httpjson.yml.hbs
79 lines (79 loc) · 1.95 KB
/
httpjson.yml.hbs
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
config_version: "2"
interval: {{interval}}
auth.basic.user: {{username}}
auth.basic.password: {{password}}
cursor:
index_earliest:
value: '[[.last_event.result.max_indextime]]'
request.url: {{url}}/services/search/jobs/export
{{#if ssl}}
request.ssl: {{ssl}}
{{/if}}
request.method: POST
request.transforms:
- set:
target: url.params.search
value: |-
{{search}} | streamstats max(_indextime) AS max_indextime
- set:
target: url.params.output_mode
value: "json"
- set:
target: url.params.index_earliest
value: '[[ .cursor.index_earliest ]]'
default: '[[(now (parseDuration "-{{interval}}")).Unix]]'
- set:
target: url.params.index_latest
value: '[[(now).Unix]]'
- set:
target: header.Content-Type
value: application/x-www-form-urlencoded
response.decode_as: application/x-ndjson
tags:
{{#each tags as |tag i|}}
- {{tag}}
{{/each}}
{{#if preserve_original_event}}
- preserve_original_event
{{/if}}
{{#contains tags "forwarded"}}
publisher_pipeline.disable_host: true
{{/contains}}
processors:
- decode_json_fields:
fields: message
target: json
add_error_key: true
- drop_event:
when:
not:
has_fields: ['json.result']
- fingerprint:
fields:
- json.result._cd
- json.result._indextime
- json.result._raw
- json.result._time
- json.result.host
- json.result.source
target_field: "@metadata._id"
- drop_fields:
fields: message
- rename:
fields:
- from: json.result._raw
to: event.original
- from: json.result.host
to: host.name
- from: json.result.source
to: event.provider
ignore_missing: true
fail_on_error: false
- drop_fields:
fields: json
- decode_xml_wineventlog:
field: event.original
target_field: winlog
ignore_missing: true
ignore_failure: true
map_ecs_fields: true