CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-08 02:02:50 +01:00
Code Issues Packages Projects Releases Wiki Activity

Issue #885: so-elastic-clear not removing so-* indices

Browse Source
This commit is contained in:
bryant-treacle
2020-06-24 17:21:58 +00:00
parent c3651f1b45
commit 0849014b24
1 changed files with 23 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
salt/common/tools/sbin/so-elastic-clear
View File

@@ -13,9 +13,7 @@
# GNU General Public License for more details. # GNU General Public License for more details.
# #
# You should have received a copy of the GNU General Public License # You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>. # along with this program. If not, see <http://www.gnu.org/licenses/>.. /usr/sbin/so-common
{%- set MASTERIP = salt['pillar.get']('static:masterip', '') -%}
. /usr/sbin/so-common
SKIP=0 SKIP=0
######################################### #########################################
@@ -50,7 +48,7 @@ done
if [ $SKIP -ne 1 ]; then if [ $SKIP -ne 1 ]; then
# List indices # List indices
echo echo
curl {{ MASTERIP }}:9200/_cat/indices?v&pretty curl {{ MASTERIP }}:9200/_cat/indices?v
echo echo
# Inform user we are about to delete all data # Inform user we are about to delete all data
echo echo
@@ -63,18 +61,34 @@ if [ $SKIP -ne 1 ]; then
if [ "$INPUT" != "AGREE" ] ; then exit 0; fi if [ "$INPUT" != "AGREE" ] ; then exit 0; fi
fi fi
/usr/sbin/so-filebeat-stop # Check to see if Logstash/Filebeat are running
/usr/sbin/so-logstash-stop LS_ENABLED=$(so-status | grep logstash)
FB_ENABLED=$(so-status | grep filebeat)
if [ ! -z "$FB_ENABLED" ]; then
/usr/sbin/so-filebeat-stop
elif [ ! -z "$LS_ENABLED" ]; then
/usr/sbin/so-logstash-stop
fi
# Delete data # Delete data
echo "Deleting data..." echo "Deleting data..."
INDXS=$(curl -s -XGET {{ MASTERIP }}:9200/_cat/indices?v | egrep 'logstash|elastalert' | awk '{ print $3 }') INDXS=$(curl -s -XGET {{ MASTERIP }}:9200/_cat/indices?v | egrep 'logstash|elastalert|so-' | awk '{ print $3 }')
for INDX in ${INDXS} for INDX in ${INDXS}
do do
curl -XDELETE "{{ MASTERIP }}:9200/${INDX}" > /dev/null 2>&1 curl -XDELETE "{{ MASTERIP }}:9200/${INDX}" > /dev/null 2>&1
done done
/usr/sbin/so-logstash-start #Start Logstash/Filebeat
/usr/sbin/so-filebeat-start if [ ! -z "$FB_ENABLED" ]; then
/usr/sbin/so-filebeat-start
elif [ ! -z "$LS_ENABLED" ]; then
/usr/sbin/so-logstash-start
fi