From 910caf6bd36792222eb2567c62974954b1781af2 Mon Sep 17 00:00:00 2001
From: AlfonsoRBJ <sitoruizbravo@hotmail.com>
Date: Tue, 5 Nov 2019 16:20:37 +0100
Subject: [PATCH] Fixed the option to change Filebeat output (#268)

---
 wazuh/config/01-wazuh.sh                    | 17 -----------------
 wazuh/config/02-set_filebeat_destination.sh |  6 ++++++
 2 files changed, 6 insertions(+), 17 deletions(-)

diff --git a/wazuh/config/01-wazuh.sh b/wazuh/config/01-wazuh.sh
index 4e333658..e70a0bef 100644
--- a/wazuh/config/01-wazuh.sh
+++ b/wazuh/config/01-wazuh.sh
@@ -197,20 +197,6 @@ change_api_user_credentials() {
 }
 
 
-
-
-##############################################################################
-# Customize filebeat output ip
-##############################################################################
-
-
-custom_filebeat_output_ip() {
-  if [ "$FILEBEAT_OUTPUT" != "" ]; then
-    sed -i "s/logstash:5000/$FILEBEAT_OUTPUT:5000/" /etc/filebeat/filebeat.yml
-  fi
-}
-
-
 ##############################################################################
 # Main function
 ##############################################################################
@@ -255,9 +241,6 @@ main() {
   # Change API user credentials
   change_api_user_credentials
 
-  # Update filebeat configuration
-  custom_filebeat_output_ip
-
   # Delete temporary data folder
   rm -rf ${WAZUH_INSTALL_PATH}/data_tmp
 
diff --git a/wazuh/config/02-set_filebeat_destination.sh b/wazuh/config/02-set_filebeat_destination.sh
index dc7478c2..3ba11dfa 100644
--- a/wazuh/config/02-set_filebeat_destination.sh
+++ b/wazuh/config/02-set_filebeat_destination.sh
@@ -9,11 +9,17 @@ if [[ $FILEBEAT_DESTINATION == "elasticsearch" ]]; then
 
     echo "FILEBEAT - Set destination to Elasticsearch"
     cp filebeat_to_elasticsearch.yml /etc/filebeat/filebeat.yml
+    if [[ $FILEBEAT_OUTPUT != "" ]]; then
+        sed -i "s/elasticsearch:9200/$FILEBEAT_OUTPUT:9200/" /etc/filebeat/filebeat.yml
+    fi
 
 elif [[ $FILEBEAT_DESTINATION == "logstash" ]]; then
 
     echo "FILEBEAT - Set destination to Logstash"
     cp filebeat_to_logstash.yml /etc/filebeat/filebeat.yml
+    if [[ $FILEBEAT_OUTPUT != "" ]]; then
+        sed -i "s/logstash:5000/$FILEBEAT_OUTPUT:5000/" /etc/filebeat/filebeat.yml
+    fi
 
 else
     echo "FILEBEAT - Error choosing destination. Set default filebeat.yml "