Addition of logstash configs

logstash/1000_nessus_preprocess_nessus.conf

@@ -4,6 +4,22 @@
 # Version 0.2
 # Description: Take in nessus reports from vulnWhisperer and pumps into logstash
 
+input {
+  beats {
+    port => 5044
+    tags => "beats"
+  }
+}
+
+filter {
+  if [beat][hostname] == "filebeathost" {
+    mutate {
+      add_tag => ["nessus"]
+    }
+  }
+}
+
+
 filter {
   if "nessus" in [tags]{
     mutate {
@@ -85,7 +101,7 @@ filter {
     }
 
     # Add tags for reporting based on assets or criticality
-    if [host] == "192.168.0.1" or [host] == "192.168.0.50" or [host] =~ "^192\.168\.10\." or [host] =~ "^192\.168\.5\." {
+    if [host] == "192.168.0.1" or [host] == "192.168.0.50" or [host] =~ "^192\.168\.10\." or [host] =~ "^42.42.42." {
       mutate {
         add_tag => [ "critical_asset" ]
       }
@@ -111,3 +127,14 @@ filter {
     }
   }
 }
+}
+
+output {
+   if "nessus" in [tags]  or [type] == "nessus" {
+    #stdout { codec => rubydebug }
+    elasticsearch {
+      hosts => [ "localhost" ]
+      index => "logstash-nessus-%{+YYYY.MM}"
+    }
+  }
+}