diff --git a/packages/cisco_ios/_dev/deploy/docker/docker-compose.yml b/packages/cisco_ios/_dev/deploy/docker/docker-compose.yml index d92d2bf6f8e..d5dfb631bac 100644 --- a/packages/cisco_ios/_dev/deploy/docker/docker-compose.yml +++ b/packages/cisco_ios/_dev/deploy/docker/docker-compose.yml @@ -6,8 +6,13 @@ services: - ./sample_logs:/sample_logs:ro - ${SERVICE_LOGS_DIR}:/var/log command: /bin/sh -c "cp /sample_logs/* /var/log/" + cisco-ios-tcp: + image: docker.elastic.co/observability/stream:v0.6.2 + volumes: + - ./sample_logs:/sample_logs:ro + command: log --start-signal=SIGHUP --delay=5s --addr elastic-agent:9514 -p=tcp /sample_logs/cisco-ios.log cisco-ios-udp: - image: docker.elastic.co/observability/stream:v0.5.0 + image: docker.elastic.co/observability/stream:v0.6.2 volumes: - ./sample_logs:/sample_logs:ro command: log --start-signal=SIGHUP --delay=5s --addr elastic-agent:9514 -p=udp /sample_logs/cisco-ios.log diff --git a/packages/cisco_ios/changelog.yml b/packages/cisco_ios/changelog.yml index 9e729b8404d..dbf9326aa29 100644 --- a/packages/cisco_ios/changelog.yml +++ b/packages/cisco_ios/changelog.yml @@ -1,4 +1,9 @@ # newer versions go on top +- version: "1.6.0" + changes: + - description: Add TCP input with TLS support + type: enhancement + link: https://github.com/elastic/integrations/pull/3314 - version: "1.5.0" changes: - description: Update to ECS 8.2 diff --git a/packages/cisco_ios/data_stream/log/_dev/test/system/test-tcp-config.yml b/packages/cisco_ios/data_stream/log/_dev/test/system/test-tcp-config.yml new file mode 100644 index 00000000000..c54d30dbf4f --- /dev/null +++ b/packages/cisco_ios/data_stream/log/_dev/test/system/test-tcp-config.yml @@ -0,0 +1,8 @@ +service: cisco-ios-tcp +service_notify_signal: SIGHUP +input: tcp +data_stream: + vars: + syslog_host: 0.0.0.0 + syslog_port: 9514 + preserve_original_event: true diff --git a/packages/cisco_ios/data_stream/log/agent/stream/tcp.yml.hbs b/packages/cisco_ios/data_stream/log/agent/stream/tcp.yml.hbs new file mode 100644 index 00000000000..4a401c1add1 --- /dev/null +++ b/packages/cisco_ios/data_stream/log/agent/stream/tcp.yml.hbs @@ -0,0 +1,27 @@ +host: "{{syslog_host}}:{{syslog_port}}" +tags: +{{#if preserve_original_event}} + - preserve_original_event +{{/if}} +{{#each tags as |tag i|}} + - {{tag}} +{{/each}} +{{#contains "forwarded" tags}} +publisher_pipeline.disable_host: true +{{/contains}} +{{#if ssl}} +ssl: {{ssl}} +{{/if}} +fields_under_root: true +fields: + _conf: + tz_offset: '{{tz_offset}}' + +processors: +- add_locale: ~ +{{#if processors}} +{{processors}} +{{/if}} +{{#if tcp_options}} +{{tcp_options}} +{{/if}} \ No newline at end of file diff --git a/packages/cisco_ios/data_stream/log/manifest.yml b/packages/cisco_ios/data_stream/log/manifest.yml index 6bb969b075a..161d335aa79 100644 --- a/packages/cisco_ios/data_stream/log/manifest.yml +++ b/packages/cisco_ios/data_stream/log/manifest.yml @@ -54,6 +54,99 @@ streams: description: > Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + - input: tcp + title: Cisco IOS logs + description: Collect Cisco IOS logs + template_path: tcp.yml.hbs + vars: + - name: tags + type: text + title: Tags + multi: true + required: true + show_user: false + default: + - cisco-ios + - forwarded + - name: syslog_host + type: text + title: Host to listen on + multi: false + required: true + show_user: true + default: localhost + - name: syslog_port + type: integer + title: Syslog Port + multi: false + required: true + show_user: true + default: 9002 + - name: preserve_original_event + required: true + show_user: true + title: Preserve original event + description: Preserves a raw copy of the original event, added to the field `event.original` + type: bool + multi: false + default: false + - name: tz_offset + type: text + title: Timezone + multi: false + required: true + show_user: false + default: UTC + description: IANA time zone or time offset (e.g. `+0200`) to use when interpreting syslog timestamps without a time zone. + - name: processors + type: yaml + title: Processors + multi: false + required: false + show_user: false + description: > + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + + - name: ssl + type: yaml + title: SSL Configuration + description: i.e. certificate_authorities, supported_protocols, verification_mode etc. + multi: false + required: false + show_user: false + default: | + #certificate_authorities: + # - | + # -----BEGIN CERTIFICATE----- + # MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF + # ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2 + # MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB + # BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n + # fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl + # 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t + # /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP + # PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41 + # CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O + # BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux + # 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D + # 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw + # 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA + # H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu + # 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0 + # yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk + # sxSmbIUfc2SGJGCJD4I= + # -----END CERTIFICATE----- + - name: tcp_options + type: yaml + title: Custom TCP Options + multi: false + required: false + show_user: false + default: | + #max_connections: 1 + #framing: delimitier + #line_delimiter: "\n" + description: Specify custom configuration options for the TCP input. - input: logfile enabled: false title: Cisco IOS logs diff --git a/packages/cisco_ios/manifest.yml b/packages/cisco_ios/manifest.yml index 29446657265..66155027bbb 100644 --- a/packages/cisco_ios/manifest.yml +++ b/packages/cisco_ios/manifest.yml @@ -1,7 +1,7 @@ format_version: 1.0.0 name: cisco_ios title: Cisco IOS -version: 1.5.0 +version: 1.6.0 license: basic description: Collect logs from Cisco IOS with Elastic Agent. type: integration @@ -21,6 +21,9 @@ policy_templates: title: Cisco IOS logs description: Collect logs from Cisco IOS instances inputs: + - type: tcp + title: Collect logs from Cisco IOS via TCP + description: Collecting logs from Cisco IOS via TCP - type: udp title: Collect logs from Cisco IOS via UDP description: Collecting logs from Cisco IOS via UDP