logstash.conf.tmpl

input {
  elastic_agent {
    port => 5044
    ssl_enabled => true
    ssl_certificate_authorities => ["/usr/share/logstash/config/certs/ca-cert.pem"]
    ssl_certificate => "/usr/share/logstash/config/certs/cert.pem"
    ssl_key => "/usr/share/logstash/config/certs/key.pem"
  }
}

{{ $elasticsearch_host := fact "elasticsearch_host" -}}
filter {
  elastic_integration {
    remove_field => ['@version']
    hosts => ["{{ $elasticsearch_host }}"]
    username => '{{ fact "username" }}'
    password => '{{ fact "password" }}'
    ssl_enabled => true
    ssl_verification_mode => "none"
  }
}

output {
  if [@metadata][_ingest_document][id] {
    elasticsearch {
      hosts => ["{{ $elasticsearch_host }}"]
      user => '{{ fact "username" }}'
      password => '{{ fact "password" }}'
      ssl_enabled => true
  {{- if eq $elasticsearch_host "https://elasticsearch:9200" }}
      ssl_certificate_authorities => "/usr/share/logstash/config/certs/ca-cert.pem"
      document_id => "%{[@metadata][_ingest_document][id]}"
  {{- end }}
    }
  } else {
    elasticsearch {
      hosts => ["{{ $elasticsearch_host }}"]
      user => '{{ fact "username" }}'
      password => '{{ fact "password" }}'
      ssl_enabled => true
  {{- if eq $elasticsearch_host "https://elasticsearch:9200" }}
      ssl_certificate_authorities => "/usr/share/logstash/config/certs/ca-cert.pem"
  {{- end }}
    }
  }
}