CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 09:12:45 +01:00
Code Issues Packages Projects Releases Wiki Activity

get 200 from es before collecting metrics

Browse Source
This commit is contained in:
reyesj2
2025-04-30 13:05:36 -05:00
parent b918a5e256
commit 044d230158
1 changed files with 34 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files

64
salt/telegraf/scripts/esindexsize.sh
View File

@@ -5,37 +5,41 @@
# https://securityonion.net/license; you may not use this file except in compliance with the
# Elastic License 2.0.
DATASTREAM_INFO=$(curl -K /etc/telegraf/elasticsearch.config -s -k -L "https://localhost:9200/_data_stream?format=json")
INDICES=$(curl -K /etc/telegraf/elasticsearch.config -s -k -L "https://localhost:9200/_cat/indices?h=index,store.size&bytes=b&s=index:asc&format=json")
INDICES_WITH_SIZE=()
if curl -K /etc/telegraf/elasticsearch.config -s -k -L "https://localhost:9200/" -w "%{http_code}" -o /dev/null | grep -q '200'; then
while IFS= read -r DS; do
datastream_indices=()
datastream=$(echo "$DS" | jq -r '.name')
# influx doesn't like key starting with '.'
if [[ $datastream != .* ]]; then
while IFS= read -r DS_IDX; do
datastream_indices+=("$DS_IDX")
done < <(echo "$DS" | jq -r '.indices[].index_name')
datastream_size=0
DATASTREAM_INFO=$(curl -K /etc/telegraf/elasticsearch.config -s -k -L "https://localhost:9200/_data_stream?format=json")
INDICES=$(curl -K /etc/telegraf/elasticsearch.config -s -k -L "https://localhost:9200/_cat/indices?h=index,store.size&bytes=b&s=index:asc&format=json")
INDICES_WITH_SIZE=()
for idx in ${datastream_indices[@]}; do
current_index=$(echo "$INDICES" | jq -r --arg index "$idx" '.[] | select(.index == $index)["store.size"]')
datastream_size=$(($datastream_size + $current_index))
done
INDICES_WITH_SIZE+=("${datastream}=${datastream_size}i")
# echo "$datastream size is $(echo "$datastream_size" | numfmt --to iec)"
fi
done < <(echo "$DATASTREAM_INFO" | jq -c '.data_streams[]')
while IFS= read -r DS; do
datastream_indices=()
datastream=$(echo "$DS" | jq -r '.name')
# influx doesn't like key starting with '.'
if [[ $datastream != .* ]]; then
while IFS= read -r DS_IDX; do
datastream_indices+=("$DS_IDX")
done < <(echo "$DS" | jq -r '.indices[].index_name')
datastream_size=0
measurement="elasticsearch_index_size "
total=${#INDICES_WITH_SIZE[@]}
for idxws in "${!INDICES_WITH_SIZE[@]}"; do
if [[ $idxws -lt $(($total - 1)) ]]; then
measurement+="${INDICES_WITH_SIZE[$idxws]},"
else
measurement+="${INDICES_WITH_SIZE[$idxws]}"
fi
done
for idx in ${datastream_indices[@]}; do
current_index=$(echo "$INDICES" | jq -r --arg index "$idx" '.[] | select(.index == $index)["store.size"]')
datastream_size=$(($datastream_size + $current_index))
done
INDICES_WITH_SIZE+=("${datastream}=${datastream_size}i")
# echo "$datastream size is $(echo "$datastream_size" | numfmt --to iec)"
fi
done < <(echo "$DATASTREAM_INFO" | jq -c '.data_streams[]')
echo "$measurement"
measurement="elasticsearch_index_size "
total=${#INDICES_WITH_SIZE[@]}
for idxws in "${!INDICES_WITH_SIZE[@]}"; do
if [[ $idxws -lt $(($total - 1)) ]]; then
measurement+="${INDICES_WITH_SIZE[$idxws]},"
else
measurement+="${INDICES_WITH_SIZE[$idxws]}"
fi
done
echo "$measurement"
fi