File: //usr/share/filebeat/module/cisco/ftd/config/input.yml
{{ if eq .input "file" }}
type: log
paths:
{{ range $i, $path := .paths }}
- {{$path}}
{{ end }}
exclude_files: [".gz$"]
{{ else if eq .input "syslog" }}
type: udp
host: "{{.syslog_host}}:{{.syslog_port}}"
{{ else }}
type: {{.input}}
host: "{{.syslog_host}}:{{.syslog_port}}"
ssl: {{ .ssl | tojson }}
{{ end }}
tags: {{.tags | tojson}}
publisher_pipeline.disable_host: {{ inList .tags "forwarded" }}
processors:
- add_locale: ~
- add_fields:
target: ''
fields:
ecs.version: 1.12.0
{{ if .timezone_offset }}
- add_fields:
target: _temp_
fields:
timezone_offset: "{{ .timezone_offset }}"
{{ end }}
{{ if .external_zones }}
- add_fields:
target: _temp_
fields:
external_zones: {{ .external_zones | tojson }}
{{ end }}
{{ if .internal_zones }}
- add_fields:
target: _temp_
fields:
internal_zones: {{ .internal_zones | tojson }}
{{ end }}