Skip to content

Commit aac7dfe

Browse files
0xThiebaut0xThiebaut
committed
sysutils/beats8: initial Filebeat support
1 parent 16c993a commit aac7dfe

File tree

15 files changed

+887
-0
lines changed

15 files changed

+887
-0
lines changed

‎sysutils/beats8/Makefile‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
PLUGIN_NAME= beats8
2+
PLUGIN_VERSION= 1.0
3+
PLUGIN_REVISION= 0
4+
PLUGIN_COMMENT= Send logs, network, metrics and heartbeat to elasticsearch
5+
PLUGIN_DEPENDS= beats8
6+
PLUGIN_MAINTAINER= 0xThiebaut
7+
8+
.include "../../Mk/plugins.mk"

‎sysutils/beats8/pkg-descr‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
Beats is the platform for building lightweight, open source data
2+
shippers for many types of operational data you want to enrich with
3+
Logstash, search and analyze in Elasticsearch, and visualize in Kibana.
4+
5+
Filebeat is a lightweight, open source shipper for log file data. As the
6+
next-generation Logstash Forwarder, Filebeat tails logs and quickly
7+
sends this information to Logstash for further parsing and enrichment or
8+
to Elasticsearch for centralized storage and analysis.
9+
10+
The OPNsense Beats plugin only initializes Elasticsearch;
11+
It doesn't load Kibana dashboards.
12+
13+
WWW: https://www.elastic.co/guide/en/beats

‎sysutils/beats8/src/opnsense/mvc/app/controllers/OPNsense/Filebeat/Api/ServiceController.php‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
<?php
2+
3+
/**
4+
* Copyright (C) 2025 Maxime THIEBAUT
5+
*
6+
* All rights reserved.
7+
*
8+
* Redistribution and use in source and binary forms, with or without
9+
* modification, are permitted provided that the following conditions are met:
10+
*
11+
* 1. Redistributions of source code must retain the above copyright notice,
12+
* this list of conditions and the following disclaimer.
13+
*
14+
* 2. Redistributions in binary form must reproduce the above copyright
15+
* notice, this list of conditions and the following disclaimer in the
16+
* documentation and/or other materials provided with the distribution.
17+
*
18+
* THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES,
19+
* INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
20+
* AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
21+
* AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
22+
* OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
23+
* SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
24+
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
25+
* CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
26+
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
27+
* POSSIBILITY OF SUCH DAMAGE.
28+
*
29+
*/
30+
31+
namespace OPNsense\Filebeat\Api;
32+
33+
use OPNsense\Base\ApiMutableServiceControllerBase;
34+
35+
/**
36+
* Class ServiceController
37+
* @package OPNsense\Filebeat
38+
*/
39+
class ServiceController extends ApiMutableServiceControllerBase
40+
{
41+
protected static $internalServiceClass = '\OPNsense\Beats8\Filebeat';
42+
protected static $internalServiceTemplate = 'OPNsense/Filebeat';
43+
protected static $internalServiceEnabled = 'enabled';
44+
protected static $internalServiceName = 'filebeat';
45+
protected function reconfigureForceRestart()
46+
{
47+
return 0;
48+
}
49+
}

‎sysutils/beats8/src/opnsense/mvc/app/controllers/OPNsense/Filebeat/Api/SettingsController.php‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
<?php
2+
3+
/**
4+
* Copyright (C) 2025 Maxime THIEBAUT
5+
*
6+
* All rights reserved.
7+
*
8+
* Redistribution and use in source and binary forms, with or without
9+
* modification, are permitted provided that the following conditions are met:
10+
*
11+
* 1. Redistributions of source code must retain the above copyright notice,
12+
* this list of conditions and the following disclaimer.
13+
*
14+
* 2. Redistributions in binary form must reproduce the above copyright
15+
* notice, this list of conditions and the following disclaimer in the
16+
* documentation and/or other materials provided with the distribution.
17+
*
18+
* THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES,
19+
* INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
20+
* AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
21+
* AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
22+
* OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
23+
* SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
24+
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
25+
* CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
26+
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
27+
* POSSIBILITY OF SUCH DAMAGE.
28+
*
29+
*/
30+
31+
namespace OPNsense\Filebeat\Api;
32+
33+
use OPNsense\Base\ApiMutableModelControllerBase;
34+
35+
/**
36+
* Class SettingsController Handles settings related API actions for the HelloWorld module
37+
* @package OPNsense\Filebeat
38+
*/
39+
class SettingsController extends ApiMutableModelControllerBase
40+
{
41+
protected static $internalModelClass = 'OPNsense\Beats8\Filebeat';
42+
protected static $internalModelName = 'filebeat';
43+
}

‎sysutils/beats8/src/opnsense/mvc/app/controllers/OPNsense/Filebeat/IndexController.php‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
<?php
2+
3+
/**
4+
* Copyright (C) 2025 Maxime THIEBAUT
5+
*
6+
* All rights reserved.
7+
*
8+
* Redistribution and use in source and binary forms, with or without
9+
* modification, are permitted provided that the following conditions are met:
10+
*
11+
* 1. Redistributions of source code must retain the above copyright notice,
12+
* this list of conditions and the following disclaimer.
13+
*
14+
* 2. Redistributions in binary form must reproduce the above copyright
15+
* notice, this list of conditions and the following disclaimer in the
16+
* documentation and/or other materials provided with the distribution.
17+
*
18+
* THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES,
19+
* INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
20+
* AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
21+
* AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
22+
* OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
23+
* SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
24+
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
25+
* CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
26+
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
27+
* POSSIBILITY OF SUCH DAMAGE.
28+
*
29+
*/
30+
31+
namespace OPNsense\Filebeat;
32+
33+
/**
34+
* Class IndexController
35+
* @package OPNsense\Filebeat
36+
*/
37+
class IndexController extends \OPNsense\Base\IndexController
38+
{
39+
public function indexAction()
40+
{
41+
// pick the template to serve to our users.
42+
$this->view->pick('OPNsense/Beats8/filebeat');
43+
// fetch form data "general" in
44+
$this->view->generalForm = $this->getForm("filebeat");
45+
}
46+
}

‎sysutils/beats8/src/opnsense/mvc/app/controllers/OPNsense/Filebeat/forms/filebeat.xml‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
<form>
2+
<field>
3+
<id>filebeat.enabled</id>
4+
<label>Enabled</label>
5+
<type>checkbox</type>
6+
<help>Enable the Filebeat service.</help>
7+
</field>
8+
<field>
9+
<id>filebeat.modules.enabled</id>
10+
<label>Modules</label>
11+
<type>select_multiple</type>
12+
<help>The Filebeat modules to enable.</help>
13+
</field>
14+
<field>
15+
<id>filebeat.inputs.enabled</id>
16+
<label>Inputs</label>
17+
<type>select_multiple</type>
18+
<help>The Filebeat inputs to enable.</help>
19+
</field>
20+
<field>
21+
<label>Elasticsearch</label>
22+
<type>header</type>
23+
</field>
24+
<field>
25+
<id>filebeat.output.elasticsearch.hosts</id>
26+
<label>Host</label>
27+
<type>text</type>
28+
<help>The Elasticsearch host to which Filebeat should send its logs. IPv6 addresses should always be defined as: https://[2001:db8::1]:9200.</help>
29+
<hint>http://localhost:9200</hint>
30+
</field>
31+
<field>
32+
<id>filebeat.output.elasticsearch.api_key</id>
33+
<label>API Key</label>
34+
<type>password</type>
35+
<help>The authentication API key in its id:api_key format.</help>
36+
<hint>id:api_key</hint>
37+
</field>
38+
<field>
39+
<id>filebeat.output.elasticsearch.ssl.verification_mode</id>
40+
<label>SSL Verification</label>
41+
<type>dropdown</type>
42+
<help>Controls the verification of certificates. The full mode verifies that the provided certificate is signed by a trusted authority (CA) and also verifies that the server's hostname (or IP address) matches the names identified within the certificate. The strict mode is similar to full mode, but requires the Subject Alternative Name to be defined as well. The certificate mode verifies that the provided certificate is signed by a trusted authority (CA), but does not perform any hostname verification.</help>
43+
<advanced>true</advanced>
44+
</field>
45+
<field>
46+
<id>filebeat.output.elasticsearch.ssl.ca_trusted_fingerprint</id>
47+
<label>SSL Fingerprint</label>
48+
<type>text</type>
49+
<help>A HEX encoded root CA SHA256 fingerprint added to the list of trusted CAs before SSL validation happens.</help>
50+
<hint>CA:FE:BA:BE:...</hint>
51+
<advanced>true</advanced>
52+
</field>
53+
</form>

‎sysutils/beats8/src/opnsense/mvc/app/models/OPNsense/Beats8/ACL/ACL.xml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
<acl>
2+
<page-services-beats8>
3+
<name>Services: Beats8</name>
4+
<patterns>
5+
<pattern>ui/filebeat/*</pattern>
6+
<pattern>api/filebeat/*</pattern>
7+
</patterns>
8+
</page-services-beats8>
9+
</acl>

‎sysutils/beats8/src/opnsense/mvc/app/models/OPNsense/Beats8/Filebeat.php‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
<?php
2+
3+
/**
4+
* Copyright (C) 2025 Maxime THIEBAUT
5+
*
6+
* All rights reserved.
7+
*
8+
* Redistribution and use in source and binary forms, with or without
9+
* modification, are permitted provided that the following conditions are met:
10+
*
11+
* 1. Redistributions of source code must retain the above copyright notice,
12+
* this list of conditions and the following disclaimer.
13+
*
14+
* 2. Redistributions in binary form must reproduce the above copyright
15+
* notice, this list of conditions and the following disclaimer in the
16+
* documentation and/or other materials provided with the distribution.
17+
*
18+
* THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES,
19+
* INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
20+
* AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
21+
* AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
22+
* OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
23+
* SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
24+
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
25+
* CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
26+
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
27+
* POSSIBILITY OF SUCH DAMAGE.
28+
*
29+
*/
30+
31+
namespace OPNsense\Beats8;
32+
33+
use OPNsense\Base\BaseModel;
34+
use OPNsense\Base\Messages\Message;
35+
36+
class Filebeat extends BaseModel
37+
{
38+
/**
39+
* {@inheritdoc}
40+
*/
41+
public function performValidation($validateFullModel = false)
42+
{
43+
$messages = parent::performValidation($validateFullModel);
44+
45+
if ($validateFullModel || $this->modules->enabled->isFieldChanged() || $this->inputs->enabled->isFieldChanged()) {
46+
if ($this->modules->enabled->isEmpty() && $this->inputs->enabled->isEmpty()) {
47+
$messages->appendMessage(
48+
new Message(
49+
gettext("Either an input or module needs to be specified."),
50+
$this->modules->enabled->__reference
51+
)
52+
);
53+
$messages->appendMessage(
54+
new Message(
55+
gettext("Either an input or module needs to be specified."),
56+
$this->inputs->enabled->__reference
57+
)
58+
);
59+
}
60+
}
61+
62+
return $messages;
63+
}
64+
}

‎sysutils/beats8/src/opnsense/mvc/app/models/OPNsense/Beats8/Filebeat.xml‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
<model>
2+
<mount>//OPNsense/filebeat</mount>
3+
<description>
4+
Send logs to elasticsearch
5+
</description>
6+
<items>
7+
<enabled type="BooleanField">
8+
<Default>0</Default>
9+
<Required>Y</Required>
10+
</enabled>
11+
<modules>
12+
<enabled type="OptionField">
13+
<OptionValues>
14+
<suricata>Suricata (Intrusion Detection)</suricata>
15+
</OptionValues>
16+
<Multiple>Y</Multiple>
17+
</enabled>
18+
</modules>
19+
<inputs>
20+
<enabled type="OptionField">
21+
<Default>audit</Default>
22+
<OptionValues>
23+
<audit>Audit</audit>
24+
<configd>Backend</configd>
25+
<boot>Boot</boot>
26+
<system>General</system>
27+
<lighttpd>Web GUI</lighttpd>
28+
</OptionValues>
29+
<Multiple>Y</Multiple>
30+
</enabled>
31+
</inputs>
32+
<output>
33+
<elasticsearch>
34+
<hosts type="UrlField">
35+
<Required>Y</Required>
36+
</hosts>
37+
<api_key type="UpdateOnlyTextField">
38+
<Required>Y</Required>
39+
</api_key>
40+
<ssl>
41+
<verification_mode type="OptionField">
42+
<Default>Full</Default>
43+
<OptionValues>
44+
<strict>Strict</strict>
45+
<full>Full</full>
46+
<certificate>Certificate</certificate>
47+
</OptionValues>
48+
<Required>Y</Required>
49+
</verification_mode>
50+
<ca_trusted_fingerprint type="TextField"/>
51+
</ssl>
52+
</elasticsearch>
53+
</output>
54+
</items>
55+
</model>

‎sysutils/beats8/src/opnsense/mvc/app/models/OPNsense/Beats8/Menu/Menu.xml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
<menu>
2+
<Services>
3+
<Beats8 cssClass="fa fa-heartbeat fa-fw">
4+
<Filebeat url="/ui/filebeat"/>
5+
</Beats8>
6+
</Services>
7+
</menu>

0 commit comments

Comments
 (0)