CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 09:12:45 +01:00
Code Issues Packages Projects Releases Wiki Activity

get 200 from es before collecting metrics

Browse Source
This commit is contained in:
reyesj2
2025-04-30 13:05:36 -05:00
parent b918a5e256
commit 044d230158
1 changed files with 34 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
salt/telegraf/scripts/esindexsize.sh
View File

@@ -5,11 +5,13 @@
# https://securityonion.net/license; you may not use this file except in compliance with the
# Elastic License 2.0.
DATASTREAM_INFO=$(curl -K /etc/telegraf/elasticsearch.config -s -k -L "https://localhost:9200/_data_stream?format=json")
INDICES=$(curl -K /etc/telegraf/elasticsearch.config -s -k -L "https://localhost:9200/_cat/indices?h=index,store.size&bytes=b&s=index:asc&format=json")
INDICES_WITH_SIZE=()
if curl -K /etc/telegraf/elasticsearch.config -s -k -L "https://localhost:9200/" -w "%{http_code}" -o /dev/null | grep -q '200'; then
while IFS= read -r DS; do
DATASTREAM_INFO=$(curl -K /etc/telegraf/elasticsearch.config -s -k -L "https://localhost:9200/_data_stream?format=json")
INDICES=$(curl -K /etc/telegraf/elasticsearch.config -s -k -L "https://localhost:9200/_cat/indices?h=index,store.size&bytes=b&s=index:asc&format=json")
INDICES_WITH_SIZE=()
while IFS= read -r DS; do
datastream_indices=()
datastream=$(echo "$DS" | jq -r '.name')
# influx doesn't like key starting with '.'
@@ -26,16 +28,18 @@ while IFS= read -r DS; do
INDICES_WITH_SIZE+=("${datastream}=${datastream_size}i")
# echo "$datastream size is $(echo "$datastream_size" | numfmt --to iec)"
fi
done < <(echo "$DATASTREAM_INFO" | jq -c '.data_streams[]')
done < <(echo "$DATASTREAM_INFO" | jq -c '.data_streams[]')
measurement="elasticsearch_index_size "
total=${#INDICES_WITH_SIZE[@]}
for idxws in "${!INDICES_WITH_SIZE[@]}"; do
measurement="elasticsearch_index_size "
total=${#INDICES_WITH_SIZE[@]}
for idxws in "${!INDICES_WITH_SIZE[@]}"; do
if [[ $idxws -lt $(($total - 1)) ]]; then
measurement+="${INDICES_WITH_SIZE[$idxws]},"
else
measurement+="${INDICES_WITH_SIZE[$idxws]}"
fi
done
done
echo "$measurement"
echo "$measurement"
fi