Replicate Logstash config from master to other nodes

[weslambert]

Short-term

Add something like the following to the existing OnionSalt config:

/opt/onionsalt/salt/backend/init.sls:

# Create the symlink 

/opt/onionsalt/salt/sensor/logstash_config:
   file.symlink:
     - target: /etc/logstash/custom

/opt/onionsalt/salt/sensor/init.sls:

# Add Logstash config sync

ls-config-sync:
   file.recurse:
     - name: /etc/logstash/custom
     - maxdepth: 0
     - source: salt://sensor/logstash_config

[dougburks]

Submitted for testing:
https://groups.google.com/d/topic/security-onion-testing/5aJqtbKQ0hA/discussion

[dougburks]

Published:
https://blog.securityonion.net/2018/08/securityonion-onionsalt-20140917.html