Update filebeat_cobaltstrike.yml
minor change to fwd all weblogs.
example of prod CS weblogs for reason why.
./logs/..../weblog_443.log
./logs/..../weblog_80.log
@@ -19,7 +19,7 @@ filebeat.inputs:
enabled: true
fields_under_root: true
paths:
- - /root/cobaltstrike/logs/*/weblog.log
+ - /root/cobaltstrike/logs/*/weblog*
fields:
infra:
log:
