packetbeat-template.yml

packetbeat.interfaces.device: any
packetbeat.interfaces.internal_networks:
  - private

packetbeat.flows:
  timeout: 30s
  period: 10s

packetbeat.protocols:
- type: icmp
  enabled: true

- type: amqp
  ports: [5672]

- type: cassandra
  ports: [9042]

- type: dhcpv4
  ports: [67, 68]

- type: dns
  ports: [53]

- type: http
  ports: [80, 8080, 8000, 5000, 8002]

- type: memcache
  ports: [11211]

- type: mysql
  ports: [3306,3307]

- type: pgsql
  ports: [5432]

- type: redis
  ports: [6379]

- type: thrift
  ports: [9090]

- type: mongodb
  ports: [27017]

- type: nfs
  ports: [2049]

- type: tls
  ports:
    - 443   # HTTPS
    - 993   # IMAPS
    - 995   # POP3S
    - 5223  # XMPP over SSL
    - 8443
    - 8883  # Secure MQTT
    - 9243  # Elasticsearch

- type: sip
  ports: [5060]

setup.template.settings:
  index.number_of_shards: 1

output.elasticsearch:
  hosts: ["172.31.9.62:9200"]
  index: "pb-USERNAME-%{[agent.version]}-%{+yyyy.MM.dd}"

setup.template.enabled: true
setup.ilm.enabled: false
setup.template.name: "pb-USERNAME-%{[agent.version]}"
setup.template.pattern: "pb-USERNAME-%{[agent.version]}-*"


processors:
  - 
    if.contains.tags: forwarded
    then:
      - drop_fields:
          fields: [host]
    else:
      - add_host_metadata: ~
  - add_cloud_metadata: ~
  - add_docker_metadata: ~
  - detect_mime_type:
      field: http.request.body.content
      target: http.request.mime_type
  - detect_mime_type:
      field: http.response.body.content
      target: http.response.mime_type