From 0849014b249b567a7c33ddfb03491b168d1afd68 Mon Sep 17 00:00:00 2001 From: bryant-treacle Date: Wed, 24 Jun 2020 17:21:58 +0000 Subject: [PATCH 1/4] Issue #885: so-elastic-clear not removing so-* indices --- salt/common/tools/sbin/so-elastic-clear | 32 ++++++++++++++++++------- 1 file changed, 23 insertions(+), 9 deletions(-) diff --git a/salt/common/tools/sbin/so-elastic-clear b/salt/common/tools/sbin/so-elastic-clear index 2db400839..84ebcaf78 100755 --- a/salt/common/tools/sbin/so-elastic-clear +++ b/salt/common/tools/sbin/so-elastic-clear @@ -13,9 +13,7 @@ # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License -# along with this program. If not, see . -{%- set MASTERIP = salt['pillar.get']('static:masterip', '') -%} -. /usr/sbin/so-common +# along with this program. If not, see .. /usr/sbin/so-common SKIP=0 ######################################### @@ -50,7 +48,7 @@ done if [ $SKIP -ne 1 ]; then # List indices echo - curl {{ MASTERIP }}:9200/_cat/indices?v&pretty + curl {{ MASTERIP }}:9200/_cat/indices?v echo # Inform user we are about to delete all data echo @@ -63,18 +61,34 @@ if [ $SKIP -ne 1 ]; then if [ "$INPUT" != "AGREE" ] ; then exit 0; fi fi -/usr/sbin/so-filebeat-stop -/usr/sbin/so-logstash-stop +# Check to see if Logstash/Filebeat are running +LS_ENABLED=$(so-status | grep logstash) +FB_ENABLED=$(so-status | grep filebeat) + +if [ ! -z "$FB_ENABLED" ]; then + /usr/sbin/so-filebeat-stop + +elif [ ! -z "$LS_ENABLED" ]; then + + /usr/sbin/so-logstash-stop +fi # Delete data echo "Deleting data..." -INDXS=$(curl -s -XGET {{ MASTERIP }}:9200/_cat/indices?v | egrep 'logstash|elastalert' | awk '{ print $3 }') +INDXS=$(curl -s -XGET {{ MASTERIP }}:9200/_cat/indices?v | egrep 'logstash|elastalert|so-' | awk '{ print $3 }') for INDX in ${INDXS} do curl -XDELETE "{{ MASTERIP }}:9200/${INDX}" > /dev/null 2>&1 done -/usr/sbin/so-logstash-start -/usr/sbin/so-filebeat-start +#Start Logstash/Filebeat +if [ ! -z "$FB_ENABLED" ]; then + + /usr/sbin/so-filebeat-start + +elif [ ! -z "$LS_ENABLED" ]; then + + /usr/sbin/so-logstash-start +fi From 08220e3330e00bbce0b286a8f3851d0cbd600297 Mon Sep 17 00:00:00 2001 From: bryant-treacle Date: Wed, 24 Jun 2020 18:40:11 +0000 Subject: [PATCH 2/4] Issue #885: so-elastic-clear not removing so-* indices --- salt/common/tools/sbin/so-elastic-clear | 30 +++++++++++++++++++++---- test.test | 0 2 files changed, 26 insertions(+), 4 deletions(-) create mode 100644 test.test diff --git a/salt/common/tools/sbin/so-elastic-clear b/salt/common/tools/sbin/so-elastic-clear index 84ebcaf78..8e0ca877a 100755 --- a/salt/common/tools/sbin/so-elastic-clear +++ b/salt/common/tools/sbin/so-elastic-clear @@ -14,6 +14,8 @@ # # You should have received a copy of the GNU General Public License # along with this program. If not, see .. /usr/sbin/so-common +{%- set MASTERIP = salt['pillar.get']('static:masterip', '') -%} +. /usr/sbin/so-common SKIP=0 ######################################### @@ -64,13 +66,24 @@ fi # Check to see if Logstash/Filebeat are running LS_ENABLED=$(so-status | grep logstash) FB_ENABLED=$(so-status | grep filebeat) +EA_ENABLED=$(so-status | grep elastalert) if [ ! -z "$FB_ENABLED" ]; then + /usr/sbin/so-filebeat-stop -elif [ ! -z "$LS_ENABLED" ]; then +fi + +if [ ! -z "$LS_ENABLED" ]; then /usr/sbin/so-logstash-stop + +fi + +if [ ! -z "$EA_ENABLED" ]; then + + /usr/sbin/so-elastalert-stop + fi # Delete data @@ -87,8 +100,17 @@ if [ ! -z "$FB_ENABLED" ]; then /usr/sbin/so-filebeat-start -elif [ ! -z "$LS_ENABLED" ]; then - - /usr/sbin/so-logstash-start +fi + +if [ ! -z "$LS_ENABLED" ]; then + + /usr/sbin/so-logstash-start + +fi + +if [ ! -z "$EA_ENABLED" ]; then + + /usr/sbin/so-elastalert-start + fi diff --git a/test.test b/test.test new file mode 100644 index 000000000..e69de29bb From ffc9567278b11099629ac94b62388e36746a97b5 Mon Sep 17 00:00:00 2001 From: bryant-treacle Date: Wed, 24 Jun 2020 15:01:30 -0400 Subject: [PATCH 3/4] Delete test.test --- test.test | 0 1 file changed, 0 insertions(+), 0 deletions(-) delete mode 100644 test.test diff --git a/test.test b/test.test deleted file mode 100644 index e69de29bb..000000000 From 443332d5845cc002e0676be0ff9b49535429ee47 Mon Sep 17 00:00:00 2001 From: bryant-treacle Date: Wed, 24 Jun 2020 15:03:25 -0400 Subject: [PATCH 4/4] Update so-elastic-clear --- salt/common/tools/sbin/so-elastic-clear | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/salt/common/tools/sbin/so-elastic-clear b/salt/common/tools/sbin/so-elastic-clear index 8e0ca877a..f7030bc13 100755 --- a/salt/common/tools/sbin/so-elastic-clear +++ b/salt/common/tools/sbin/so-elastic-clear @@ -13,7 +13,7 @@ # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License -# along with this program. If not, see .. /usr/sbin/so-common +# along with this program. If not, see . {%- set MASTERIP = salt['pillar.get']('static:masterip', '') -%} . /usr/sbin/so-common