diff --git a/elastalert/elastalert_any_v2.yml b/elastalert/elastalert_any_v2.yml new file mode 100644 index 0000000..e9aaefd --- /dev/null +++ b/elastalert/elastalert_any_v2.yml @@ -0,0 +1,30 @@ +postprocessing: + - type: template + template: |+ + name: {{ rule.id }} + description: {{ rule.title }} + owner: {{ rule.author }} + + type: any + priority:{% set priority = ({"critical":4, "high":3, "medium":2, "low":1, "informational":0 })%} {{ priority["%s" % rule.level]}} + alert: + - debug + + {% macro index() -%} + {% if rule.logsource.product == 'windows' -%} + {% set index = 'winlogbeat-*' -%} + {% elif rule.logsource.product == 'linux' -%} + {% set index = 'linux-*' -%} + {% else -%} + {% set index = 'logs-*' -%} + {% endif -%} + {{- index }}{% endmacro -%} + index: {{ index() }} + filter: + - query: + query_string: + query: '{{ query }}' + + +finalizers: + - type: concat \ No newline at end of file