Merge pull request #2 from frack113/elastalert

feat: Add elastert template with logsource

elastalert/elastalert_any_v2.yml

@@ -0,0 +1,30 @@
+postprocessing:
+  - type: template
+    template: |+
+      name: {{ rule.id }}
+      description: {{ rule.title }}
+      owner: {{ rule.author }}
+     
+      type: any
+      priority:{% set priority = ({"critical":4, "high":3, "medium":2, "low":1, "informational":0 })%} {{ priority["%s" % rule.level]}}
+      alert:
+        - debug    
+   
+      {% macro index() -%}
+      {% if rule.logsource.product == 'windows' -%}
+      {% set index = 'winlogbeat-*' -%}
+      {% elif rule.logsource.product == 'linux' -%}
+      {% set index = 'linux-*' -%}
+      {% else -%}
+      {% set index = 'logs-*' -%}
+      {% endif -%}
+      {{- index }}{% endmacro -%}
+      index: {{ index() }}
+      filter:
+        - query:
+            query_string:
+              query: '{{ query }}'
+
+
+finalizers:
+  - type: concat