Adapting filebeat to be used instead of logstash

wazuh/Dockerfile

@@ -4,13 +4,12 @@ FROM waystonesystems/baseimage-centos:0.2.0
 # Arguments
 ARG FILEBEAT_VERSION=7.10.2
 ARG WAZUH_VERSION=4.1.5-1
-
+ARG FILEBEAT_CHANNEL=filebeat-oss
 # Environment variables
 ENV API_USER="foo" \
    API_PASS="bar"
 
 ARG TEMPLATE_VERSION="4.0"
-ENV FILEBEAT_DESTINATION="elasticsearch"
 
 RUN rpm --import https://packages.wazuh.com/key/GPG-KEY-WAZUH
 
@@ -42,8 +41,8 @@ RUN set -x && \
     rm -f /var/ossec/logs/api/*/*/* && \
     rm -f /var/ossec/logs/cluster/*/*/* && \
     rm -f /var/ossec/logs/ossec/*/*/* && \
-    curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-${FILEBEAT_VERSION}-x86_64.rpm && \
-    rpm -vi filebeat-${FILEBEAT_VERSION}-x86_64.rpm && rm -f filebeat-${FILEBEAT_VERSION}-x86_64.rpm && \
+    curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/${FILEBEAT_CHANNEL}-${FILEBEAT_VERSION}-x86_64.rpm && \
+    rpm -i ${FILEBEAT_CHANNEL}-${FILEBEAT_VERSION}-x86_64.rpm && rm -f ${FILEBEAT_CHANNEL}-${FILEBEAT_VERSION}-x86_64.rpm && \
     sed -i "s/^enabled=1/enabled=0/" /etc/yum.repos.d/wazuh.repo
 
 # Services
@@ -60,8 +59,7 @@ RUN chmod +x /etc/service/wazuh/run && \
    chmod +x /etc/service/filebeat/run 
 
 # Copy configuration files from repository
-COPY config/filebeat_to_elasticsearch.yml ./
-COPY config/filebeat_to_logstash.yml ./
+COPY config/filebeat.yml ./
 
 # Prepare permanent data
 # Sync calls are due to https://github.com/docker/docker/issues/9547
@@ -100,17 +98,15 @@ COPY config/entrypoint.sh /entrypoint.sh
 COPY --chown=root:ossec config/create_user.py /var/ossec/framework/scripts/create_user.py
 COPY config/00-decrypt_credentials.sh /entrypoint-scripts/00-decrypt_credentials.sh
 COPY config/01-wazuh.sh /entrypoint-scripts/01-wazuh.sh
-COPY config/02-set_filebeat_destination.sh /entrypoint-scripts/02-set_filebeat_destination.sh
-COPY config/03-config_filebeat.sh /entrypoint-scripts/03-config_filebeat.sh
+COPY config/02-set_config_filebeat.sh /entrypoint-scripts/02-set_config_filebeat.sh
 COPY config/20-ossec-configuration.sh /entrypoint-scripts/20-ossec-configuration.sh
 COPY config/25-backups.sh /entrypoint-scripts/25-backups.sh
 COPY config/35-remove_credentials_file.sh /entrypoint-scripts/35-remove_credentials_file.sh
 COPY config/85-save_wazuh_version.sh /entrypoint-scripts/85-save_wazuh_version.sh
 RUN chmod 755 /entrypoint.sh && \
     chmod 755 /entrypoint-scripts/00-decrypt_credentials.sh && \
     chmod 755 /entrypoint-scripts/01-wazuh.sh && \
-    chmod 755 /entrypoint-scripts/02-set_filebeat_destination.sh && \
-    chmod 755 /entrypoint-scripts/03-config_filebeat.sh && \
+    chmod 755 /entrypoint-scripts/02-set_config_filebeat.sh && \
     chmod 755 /entrypoint-scripts/20-ossec-configuration.sh && \
     chmod 755 /entrypoint-scripts/25-backups.sh && \
     chmod 755 /entrypoint-scripts/35-remove_credentials_file.sh && \
@@ -120,5 +116,8 @@ RUN chmod 755 /entrypoint.sh && \
 ADD https://raw.githubusercontent.com/wazuh/wazuh/$TEMPLATE_VERSION/extensions/elasticsearch/7.x/wazuh-template.json /etc/filebeat
 RUN chmod go-w /etc/filebeat/wazuh-template.json 
 
+# Create filebeat directories
+RUN mkdir -p /usr/share/filebeat/module/
+RUN mkdir /usr/share/filebeat/config
 # Run all services
 ENTRYPOINT ["/entrypoint.sh"]

wazuh/config/02-set_config_filebeat.sh

@@ -0,0 +1,26 @@
+#!/bin/bash
+# Wazuh Docker Copyright (C) 2019 Wazuh Inc. (License GPLv2)
+
+set -e
+
+##############################################################################
+# Set Filebeat config.  
+
+##############################################################################
+
+WAZUH_FILEBEAT_MODULE=wazuh-filebeat-0.1.tar.gz
+
+echo "FILEBEAT - Copy Filebeat config file"
+if ! [[ -L /etc/filebeat/filebeat.yml ]]; then
+    cp filebeat.yml /etc/filebeat/filebeat.yml
+    chmod go-w /etc/filebeat/filebeat.yml
+else
+    echo "Not needed. File already exist."
+fi
+echo "FILEBEAT - Set permissions"
+
+echo "FILEBEAT - Get Filebeat Wazuh module"
+
+>&2 echo "FILEBEAT - Install Wazuh Filebeat Module."
+curl -s "https://packages.wazuh.com/4.x/filebeat/${WAZUH_FILEBEAT_MODULE}" | tar -xvz -C /usr/share/filebeat/module
+chmod 755 -R /usr/share/filebeat/module/wazuh

wazuh/config/filebeat.yml

@@ -0,0 +1,19 @@
+# Wazuh Docker Copyright (C) 2019 Wazuh Inc. (License GPLv2)
+
+# Wazuh - Filebeat configuration file
+filebeat.inputs:
+  - type: log
+    paths:
+      - '/var/ossec/logs/alerts/alerts.json'
+
+setup.template.json.enabled: true
+setup.template.json.path: "/etc/filebeat/wazuh-template.json"
+setup.template.json.name: "wazuh"
+setup.template.overwrite: true
+
+
+output.elasticsearch:
+  hosts: ['http://odfe:9200']
+  #pipeline: geoip
+  indices:
+    - index: 'wazuh-alerts-4.x-%{+yyyy.MM.dd}'