Integrate filebeat into SO2.4

[SliuzasLukas]

Greetings,

I'm seeking assistance with the integration of Filebeat into Security Onion 2.4. I've already configured my SaltStack script and placed the so-filebeat-start script within the /usr/sbin/ directory. However, I'm facing a challenge: the Filebeat container isn't automatically initializing. When I manually execute the so-filebeat-start script, Filebeat operates correctly. My objective is to automate this process so that the Filebeat container automatically launches, particularly when executing the so-checkin command, to ensure seamless operation.

[cm-ops]

Is there a reason you don't want to use the elastic agent? https://docs.securityonion.net/en/2.4/elastic-agent.html

[SliuzasLukas]

Hello,

Sorry for late response. Elastic agent doesn't allow for me to have multiple outputs. We have few organizations that require certain logs.

Having one filebeat that is responsible for zeek while other is responsible for suricata logs I can change to which organization I need to send it.

[cm-ops]

Okay, this is not supported, you might be able to make this work but the Elastic Agent is the supported method.

[SliuzasLukas]

I had this working with SO2.3 and my second Filebeat container would start without any issues. Currently struggling to find a way to start my custom container on system boot

[SliuzasLukas]

Anyone can help me to implement container auto start function?

[SliuzasLukas]

I have managed to implement the filebeat into the SO. If anyone needs assistance contact me via PM