index template in config

README.md

@@ -1,7 +1,7 @@
 # evtx-nom
 EVTX log file ingestion (no Windows required) using amazing ![evtx-rs](https://github.com/omerbenamram/evtx) lib. Current target is Elasticsearch with the hope of a modular output in the future.
 
-* ECS common schema output (ive stayed close to winlogbeat however I use lowercase field names under winlog as I feel that is in spirit of ECS better than the Camel Case in winlogbeat)
+* Elasticsearch output uses ECS common schema output (ive stayed close to winlogbeat however I use lowercase field names under winlog as I feel that is in the spirit of ECS better than the Camel Case used in winlogbeat)
 
 
 ## Usage
@@ -20,7 +20,9 @@ Finished Processing sample_logs/Security.evtx in 8 seconds. ingested 31828 out o
 
 ## Config File
 
-So far I only have one outout plugin called "elastic_nom"
+So far I only have one (real) output plugin called "elastic_nom", and a demo json stdout one
+
+You add your input paths to the directory input and then choose one or more outputs.
 
 ``` json
 {
@@ -43,7 +45,8 @@ So far I only have one outout plugin called "elastic_nom"
             "es_user" : "USERNAME",
             "es_pass" : "PASSWORD",
             "es_api_key" : "APIKEY",
-            "es_scheme" : "http"
+            "es_scheme" : "http",
+            "index_template" : "es_stuff/index-template.json"
         },
         {
             "name" : "stdout_nom",
@@ -69,7 +72,8 @@ So far I only have one outout plugin called "elastic_nom"
     "es_user" : "USERNAME",
     "es_pass" : "PASSWORD",
     "es_api_key" : "APIKEY",
-    "es_scheme" : "http"
+    "es_scheme" : "http",
+    "index_template" : "es_stuff/index-template.json"
 }
 ```
 
@@ -84,4 +88,5 @@ So far I only have one outout plugin called "elastic_nom"
 | es_user | string | elasticsearch security username (for basic auth |
 | es_pass | string | elasticsearch security password ( for basic auth)|
 | es_api_key | string | base64 encoded api key (for api auth) |
-| es_scheme| string | http or https (for security you will be using https) |
+| es_scheme| string | http or https (for security you will be using https) |
+| index_template | string | path to index template, ive included one under es_stuff/index-template.json, You do not need to edit this for a custom index name as it will be done by the plugin |

config.json

@@ -18,7 +18,8 @@
             "es_user" : "USERNAME",
             "es_pass" : "PASSWORD",
             "es_api_key" : "APIKEY",
-            "es_scheme" : "http"
+            "es_scheme" : "http",
+            "index_template" : "es_stuff/index-template.json"
         },
         {
             "name" : "stdout_nom",

lib/nom.py

@@ -4,6 +4,8 @@
 from elasticsearch import helpers, Elasticsearch
 
 # This file is parsing the evtx file and any default modules
+
+# Example Standard Out Plugin
 class stdout_nom():
     def __init__(self,config):
         self.name = "standard out JSON example"
@@ -14,6 +16,7 @@ def ingest_file(self,filename):
             print("=" * 12)
         print("Finished Shouting")
 
+# Elasticsearch Plugin
 class elastic_nom():
     def __init__(self,config):
         self.name = "elasticseach ingest"
@@ -25,6 +28,7 @@ def __init__(self,config):
         self.es_pass = config['es_pass']
         self.es_api_key = config['es_api_key']
         self.scheme = config['es_scheme']
+        self.index_template = config['index_template']
         self.prep_es()
     def get_es(self):  
         if self.security == "basic":
@@ -57,8 +61,11 @@ def prep_es(self):
         # connect to es
         es = self.get_es()
         # set/reset template
-        with open("es_stuff/index-template.json","r") as t_file:
+        with open(self.index_template,"r") as t_file:
             template = json.load(t_file)
+        # If a non default index name add it to the template
+        if self.es_index != 'evtx_nom':
+            template['index_patterns'].append(self.es_index)
         es.indices.put_template(name="evtx-nom",body=template)
         return es
     def ingest_file(self,filename):