fixes #2239 addes suricata eve.json as input (#2309)

net-mgmt/telegraf/Makefile

@@ -1,5 +1,5 @@
 PLUGIN_NAME=		telegraf
-PLUGIN_VERSION=		1.9.0
+PLUGIN_VERSION=		1.10.0
 PLUGIN_COMMENT=		Agent for collecting metrics and data
 PLUGIN_DEPENDS=		telegraf
 PLUGIN_MAINTAINER=	m.muenz@gmail.com

net-mgmt/telegraf/pkg-descr

@@ -10,6 +10,9 @@ Kafka, MQTT, NSQ, and many others.
 
 Plugin Changelog
 ================
+1.10.0
+
+* Add intrusion detection alert input
 
 1.9.0
 

net-mgmt/telegraf/src/opnsense/mvc/app/controllers/OPNsense/Telegraf/forms/input.xml

@@ -137,4 +137,10 @@
         <type>checkbox</type>
         <help>Can increase metric gather times.</help>
     </field>
+    <field>
+        <id>input.intrusion_detection_alerts</id>
+        <label>Intrusion Dectection Alerts</label>
+        <type>checkbox</type>
+        <help>Requires Intrustion detection alerts are stored locally.</help>
+   </field>
 </form>

net-mgmt/telegraf/src/opnsense/mvc/app/models/OPNsense/Telegraf/Output.xml

@@ -121,5 +121,9 @@
             <default></default>
             <Required>N</Required>
         </datadog_apikey>
+        <intrusion_detection_alerts type="BooleanField">
+            <default>0</default>
+            <Required>N</Required>
+        </intrusion_detection_alerts>
     </items>
 </model>

net-mgmt/telegraf/src/opnsense/service/templates/OPNsense/Telegraf/telegraf.conf

@@ -252,6 +252,14 @@
 {%   else %}
   dns_lookup = false
 {%   endif %}
+{% if helpers.exists('OPNsense.telegraf.input.intrusion_detection_alerts') and OPNsense.telegraf.input.intrusion_detection_alerts == '1' %}
+[[inputs.tail]]
+  data_format = "json"
+  files = ["/var/log/suricata/eve.json"]
+  name_override = "suricata"
+  tag_keys = ["event_type","src_ip","src_port","dest_ip","dest_port"]
+  json_string_fields = ["*"]
+{% endif %}
 {% endif %}
 
 {% endif %}