Adding Filebeat module and adapted Elasticsearch IP

CHANGELOG.md

@@ -7,13 +7,17 @@ All notable changes to this project will be documented in this file.
 
 - Update to Wazuh version 3.9.4_7.2.0
 
-- Moved command and email_alert templates to templates/fragments. [rshad](https://github.com/rshad) [PR#143](https://github.com/wazuh/wazuh-puppet/pull/143).
+- Added Filebeat module and adapted Elasticsearch IP ([rshad](https://github.com/rshad)) [PR#144](https://github.com/wazuh/wazuh-puppet/pull/144)
 
-- Fixed integration when group is not specified. [TheoPoc](https://github.com/TheoPoc) [PR#142](https://github.com/wazuh/wazuh-puppet/pull/142).
+- Added Kitchen testing for Wazuh deployment with Puppet. ([rshad](https://github.com/rshad)) [PR#139](https://github.com/wazuh/wazuh-puppet/pull/139)
 
-- Added Ubuntu as a recognized operating system to Puppet manifests. [rshad](https://github.com/rshad) [PR#141](https://github.com/wazuh/wazuh-puppet/pull/141).
+- Moved command and email_alert templates to templates/fragments. ([rshad](https://github.com/rshad)) [PR#143](https://github.com/wazuh/wazuh-puppet/pull/143)
 
-- Made Wazuh Agent able to register and report to different IPs. ([@jm404](https://github.com/jm404)) [PR#136](https://github.com/wazuh/wazuh-puppet/pull/136).
+- Fixed integration when group is not specified. ([TheoPoc](https://github.com/TheoPoc)) [PR#142](https://github.com/wazuh/wazuh-puppet/pull/142)
+
+- Added Ubuntu as a recognized operating system to Puppet manifests. ([rshad](https://github.com/rshad)) [PR#141](https://github.com/wazuh/wazuh-puppet/pull/141)
+
+- Made Wazuh Agent able to register and report to different IPs. ([@jm404](https://github.com/jm404)) [PR#136](https://github.com/wazuh/wazuh-puppet/pull/136)
 
 
 

manifests/elasticsearch.pp

@@ -17,7 +17,7 @@
   $elasticsearch_path_logs = '/var/log/elasticsearch',
 
 
-  $elasticsearch_ip = 'localhost',
+  $elasticsearch_ip = '<YOUR_ELASTICSEARCH_IP>',
   $elasticsearch_port = '9200',
   $elasticsearch_discovery_option = 'discovery.type: single-node',
   $elasticsearch_cluster_initial_master_nodes = "#cluster.initial_master_nodes: ['es-node-01']",
@@ -27,8 +27,6 @@
 
 ){
 
-  class {'wazuh::repo_elastic':}
-
   # install package
   package { 'Installing elasticsearch...':
     ensure => $elasticsearch_version,

manifests/filebeat.pp

@@ -1,7 +1,7 @@
 # Wazuh App Copyright (C) 2019 Wazuh Inc. (License GPLv2)
 # Setup for Filebeat
 class wazuh::filebeat (
-  $filebeat_elasticsearch_ip = 'localhost',
+  $filebeat_elasticsearch_ip = '<YOUR_ELASTICSEARCH_IP>',
   $filebeat_elasticsearch_port = '9200',
   $elasticsearch_server_ip = "\"${filebeat_elasticsearch_ip}:${filebeat_elasticsearch_port}\"",
 
@@ -10,8 +10,11 @@
   $filebeat_version = '7.2.0',
   $wazuh_app_version = '3.9.4_7.2.0',
   $wazuh_extensions_version = 'v3.9.4',
+  $wazuh_filebeat_module = 'wazuh-filebeat-0.1.tar.gz',
 ){
 
+  class {'wazuh::repo_elastic':}
+
   package { 'Installing Filebeat...':
     ensure => $filebeat_version,
     name   => $filebeat_package,
@@ -32,10 +35,23 @@
     notify  => Service['filebeat']
   }
 
+  exec { 'Installing filebeat module ... Downloading package':
+   path    => '/usr/bin',
+   command => "curl -o /root/${$wazuh_filebeat_module} https://packages-dev.wazuh.com/3.x/filebeat/${$wazuh_filebeat_module}",
+  }
+
+  exec { 'Unpackaging ...':
+    command => "/bin/tar -xzvf /root/wazuh-filebeat-0.1.tar.gz -C /usr/share/filebeat/module",
+    notify  => Service['filebeat']
+  }
+
+  file { '/usr/share/filebeat/module/wazuh':
+    ensure => 'directory',
+    mode   => '0755',
+  }
+
   service { 'filebeat':
     ensure => running,
     enable => true,
   }
-
-
 }

manifests/kibana.pp

@@ -6,7 +6,7 @@
   $kibana_version = '7.2.0',
   $kibana_app_version = '3.9.4_7.2.0',
 
-  $kibana_elasticsearch_ip = 'localhost',
+  $kibana_elasticsearch_ip = '<YOUR_ELASTICSEARCH_IP>',
   $kibana_elasticsearch_port = '9200',
 
   $kibana_server_port = '5601',