CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 17:22:49 +01:00
Code Issues Packages Projects Releases Wiki Activity

get 200 from es before collecting metrics

Browse Source
This commit is contained in:
reyesj2
2025-04-30 13:05:36 -05:00
parent b918a5e256
commit 044d230158
1 changed files with 34 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files

64
salt/telegraf/scripts/esindexsize.sh
View File

@@ -5,37 +5,41 @@
# https://securityonion.net/license; you may not use this file except in compliance with the # https://securityonion.net/license; you may not use this file except in compliance with the
# Elastic License 2.0. # Elastic License 2.0.
DATASTREAM_INFO=$(curl -K /etc/telegraf/elasticsearch.config -s -k -L "https://localhost:9200/_data_stream?format=json") if curl -K /etc/telegraf/elasticsearch.config -s -k -L "https://localhost:9200/" -w "%{http_code}" -o /dev/null | grep -q '200'; then
INDICES=$(curl -K /etc/telegraf/elasticsearch.config -s -k -L "https://localhost:9200/_cat/indices?h=index,store.size&bytes=b&s=index:asc&format=json")
INDICES_WITH_SIZE=()
while IFS= read -r DS; do DATASTREAM_INFO=$(curl -K /etc/telegraf/elasticsearch.config -s -k -L "https://localhost:9200/_data_stream?format=json")
datastream_indices=() INDICES=$(curl -K /etc/telegraf/elasticsearch.config -s -k -L "https://localhost:9200/_cat/indices?h=index,store.size&bytes=b&s=index:asc&format=json")
datastream=$(echo "$DS" | jq -r '.name') INDICES_WITH_SIZE=()
# influx doesn't like key starting with '.'
if [[ $datastream != .* ]]; then
while IFS= read -r DS_IDX; do
datastream_indices+=("$DS_IDX")
done < <(echo "$DS" | jq -r '.indices[].index_name')
datastream_size=0
for idx in ${datastream_indices[@]}; do while IFS= read -r DS; do
current_index=$(echo "$INDICES" | jq -r --arg index "$idx" '.[] | select(.index == $index)["store.size"]') datastream_indices=()
datastream_size=$(($datastream_size + $current_index)) datastream=$(echo "$DS" | jq -r '.name')
done # influx doesn't like key starting with '.'
INDICES_WITH_SIZE+=("${datastream}=${datastream_size}i") if [[ $datastream != .* ]]; then
# echo "$datastream size is $(echo "$datastream_size" | numfmt --to iec)" while IFS= read -r DS_IDX; do
fi datastream_indices+=("$DS_IDX")
done < <(echo "$DATASTREAM_INFO" | jq -c '.data_streams[]') done < <(echo "$DS" | jq -r '.indices[].index_name')
datastream_size=0
measurement="elasticsearch_index_size " for idx in ${datastream_indices[@]}; do
total=${#INDICES_WITH_SIZE[@]} current_index=$(echo "$INDICES" | jq -r --arg index "$idx" '.[] | select(.index == $index)["store.size"]')
for idxws in "${!INDICES_WITH_SIZE[@]}"; do datastream_size=$(($datastream_size + $current_index))
if [[ $idxws -lt $(($total - 1)) ]]; then done
measurement+="${INDICES_WITH_SIZE[$idxws]}," INDICES_WITH_SIZE+=("${datastream}=${datastream_size}i")
else # echo "$datastream size is $(echo "$datastream_size" | numfmt --to iec)"
measurement+="${INDICES_WITH_SIZE[$idxws]}" fi
fi done < <(echo "$DATASTREAM_INFO" | jq -c '.data_streams[]')
done
echo "$measurement" measurement="elasticsearch_index_size "
total=${#INDICES_WITH_SIZE[@]}
for idxws in "${!INDICES_WITH_SIZE[@]}"; do
if [[ $idxws -lt $(($total - 1)) ]]; then
measurement+="${INDICES_WITH_SIZE[$idxws]},"
else
measurement+="${INDICES_WITH_SIZE[$idxws]}"
fi
done
echo "$measurement"
fi