Disable all outputs

[x32xx23x]

Hi,

Thanks a lot for your work.

I see that all the inputs are disabled.

For the sake of coherence and ease of automations, would it be possible to also disable all the outputs? (https://github.com/corelight/ecs-logstash-mappings/blob/main/pipeline/9940-elasticsearch-corelight_zeek-output.conf ).

Thanks in advance,

[hunter32me]

Are you installing the pipeline without the install script? The new scripts do a lot now, allowing full control of the index. You can run the script in try-out mode to create the base templates and pipeline, then use automation to push the pipeline where needed. Will that work?

[x32xx23x]

Hi. No, my ansible playbook simply checks out your latest release, copy my input and output config files in the pipeline directory, and have logstash do the rest. Currently the playbook is also deleting the output file that is not deactivated in your repo. That's the reason of my request.

Kind regards,