diff --git a/playbooks/wazuh-logstash.yml b/playbooks/wazuh-logstash.yml index 93aa256c4..5c13bd88c 100644 --- a/playbooks/wazuh-logstash.yml +++ b/playbooks/wazuh-logstash.yml @@ -1,3 +1,3 @@ - hosts: roles: - - { role: /etc/ansible/roles/wazuh-ansible/roles/elastic-stack/ansible-logstash, elasticsearch_network_host: 'localhost' } + - { role: /etc/ansible/roles/wazuh-ansible/roles/elastic-stack/ansible-logstash, elasticsearch_network_host: ["localhost"] } diff --git a/roles/elastic-stack/ansible-logstash/defaults/main.yml b/roles/elastic-stack/ansible-logstash/defaults/main.yml index 3d8842576..3c6d25b69 100644 --- a/roles/elastic-stack/ansible-logstash/defaults/main.yml +++ b/roles/elastic-stack/ansible-logstash/defaults/main.yml @@ -2,7 +2,10 @@ logstash_create_config: true logstash_input_beats: false -elasticsearch_network_host: "127.0.0.1" +#You can introduce Multiples IPs +# elasticseacrh_network_host: ["Localhost1", "Localhost2", "Localhost3", ...] +elasticsearch_network_host: ["Localhost"] + elasticsearch_http_port: "9200" elasticsearch_shards: 5 elasticsearch_replicas: 1 diff --git a/roles/elastic-stack/ansible-logstash/templates/01-wazuh.conf.j2 b/roles/elastic-stack/ansible-logstash/templates/01-wazuh.conf.j2 index e0a6f2c7c..6ef868e1b 100644 --- a/roles/elastic-stack/ansible-logstash/templates/01-wazuh.conf.j2 +++ b/roles/elastic-stack/ansible-logstash/templates/01-wazuh.conf.j2 @@ -66,7 +66,7 @@ filter { output { #stdout { codec => rubydebug } elasticsearch { - hosts => ["{{ elasticsearch_network_host }}:{{ elasticsearch_http_port }}"] + hosts => {{ elasticsearch_network_host | to_json}} index => "wazuh-alerts-3.x-%{+YYYY.MM.dd}" document_type => "wazuh" }