File: //usr/share/filebeat/module/gcp/audit/manifest.yml
module_version: "1.0"
var:
- name: input
default: gcp-pubsub
- name: project_id
default: SET_PROJECT_NAME
- name: topic
default: stackdriver-audit
- name: subscription_name
default: filebeat-gcp-audit
- name: credentials_file
- name: credentials_json
- name: keep_original_message
default: false
- name: tags
default: [forwarded]
ingest_pipeline: ingest/pipeline.yml
input: config/input.yml
requires.processors:
- name: geoip
plugin: ingest-geoip