From 2156b37b25dbcd2347333b94abe493afdd43f487 Mon Sep 17 00:00:00 2001
From: Kameron Kenny <1267885+kkenny@users.noreply.github.com>
Date: Wed, 30 Oct 2024 09:09:42 -0400
Subject: [PATCH] stats

---
 Dockerfile                         |  2 +-
 config/syslog-ng.conf.d/unifi.conf | 10 +++++++---
 docker-compose.yml                 |  2 +-
 3 files changed, 9 insertions(+), 5 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 15ac4e0..9378f04 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,7 +1,7 @@
 FROM debian:latest
 MAINTAINER Kameron Kenny <kkenny379@gmail.com>
 
-LABEL version="20241030064758"
+LABEL version="20241030090942"
 LABEL description="Debian Based syslog-ng"
 
 RUN apt-get update
diff --git a/config/syslog-ng.conf.d/unifi.conf b/config/syslog-ng.conf.d/unifi.conf
index 82e4356..4071e3d 100644
--- a/config/syslog-ng.conf.d/unifi.conf
+++ b/config/syslog-ng.conf.d/unifi.conf
@@ -48,6 +48,12 @@ parser p_suricata_src_ip_geoip2_city {
   );
 };
 
+template t_elastic {
+    $(format-json --scope rfc5424 --scope dot-nv-pairs
+    --rekey .* --shift 1 --scope nv-pairs
+    --exclude DATE @timestamp=${ISODATE})
+};
+
 destination d_unifi_fw { file("/var/log/unifi_fw.log"); };
 
 destination d_unifi_suricata {
@@ -57,9 +63,7 @@ destination d_unifi_suricata {
     user("elastic")
     password("forty6and2")
     url("http://pi501.in.thelinuxpro.net:9200/_bulk")
-    template("$(format-json --scope rfc5424 --scope dot-nv-pairs
-    --rekey .* --shift 1 --scope nv-pairs
-    --exclude DATE @timestamp=${ISODATE})")
+    template(t_elastic)
     persist-name("d_unifi_suricata")
   );
 };
diff --git a/docker-compose.yml b/docker-compose.yml
index 6af811b..0317b78 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -10,7 +10,7 @@ services:
   syslog-ng:
     build:
       dockerfile: Dockerfile
-    image: docker-registry1.in.thelinuxpro.net:5000/tlp/syslog-ng:20241030064758
+    image: docker-registry1.in.thelinuxpro.net:5000/tlp/syslog-ng:20241030090942
     container_name: syslog-ng
     restart: unless-stopped
     networks: