README.md

Elasticsearch templates

List of Elasticsearch templates, used for Stormshield product logs:

• sns-*.template.json Network Security
• sdmc-*.template.json Data For Cloud Mobility
• sds.template.json Data Enterprise
• ses-*.template.json Stormshield Endpoint Security

Installation instructions

• For Network Security logs:

find . -maxdepth 1 -name 'sns-*.template.json' -execdir bash -c 'file=${0#./}; curl --user elastic:changeme -XPUT http://<your-elasticsearch-server>:9200/_template/${file%.template.json} -H "Content-Type: application/json" -d @${file}' {} \;

• For Data For Cloud Mobility logs:

find . -maxdepth 1 -name 'sdmc-*.template.json' -execdir bash -c 'file=${0#./}; curl --user elastic:changeme -XPUT http://<your-elasticsearch-server>:9200/_template/${file%.template.json} -H "Content-Type: application/json" -d @${file}' {} \;

• For Data Enterprise logs:

  curl --user elastic:changeme -XPUT http://<your-elasticsearch-server>:9200/_template/sds -H 'Content-Type: application/json' -d @sds.template.json

• For Stormshield Endpoint Security logs:

find . -maxdepth 1 -name 'ses-*.template.json' -execdir bash -c 'file=${0#./}; curl --user elastic:changeme -XPUT http://<your-elasticsearch-server>:9200/_template/${file%.template.json} -H "Content-Type: application/json" -d @${file}' {} \;