From 21c9388ee63e46dee1102b9190c47b7bfbb9389b Mon Sep 17 00:00:00 2001
From: m0duspwnens <josh.patterson@securityonionsolutions.com>
Date: Mon, 28 Jun 2021 16:12:36 -0400
Subject: [PATCH] generate measurement list and cq for each

---
 salt/influxdb/defaults.yaml | 6 +++++-
 salt/influxdb/init.sls      | 9 +++++----
 2 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/salt/influxdb/defaults.yaml b/salt/influxdb/defaults.yaml
index 7ba83dd6d..1c7faf022 100644
--- a/salt/influxdb/defaults.yaml
+++ b/salt/influxdb/defaults.yaml
@@ -10,4 +10,8 @@ influxdb:
       shard_duration: 7d
   downsample:
     so_long_term:
-      resolution: 5m
\ No newline at end of file
+      resolution: 5m
+      measurements:
+{% for measurement in salt['cmd.run']('docker exec -t so-influxdb /bin/bash -c "influx -format json -ssl -unsafeSsl -database telegraf -execute \"show measurements\"" | jq -r ".results[0].series[0].values[][0]"') %}
+        - {{ measurement }}
+{% endfor %}
diff --git a/salt/influxdb/init.sls b/salt/influxdb/init.sls
index 346d971fd..fb84f8bc8 100644
--- a/salt/influxdb/init.sls
+++ b/salt/influxdb/init.sls
@@ -113,11 +113,12 @@ telegraf_database:
 {% endfor %}
 
 {% for dest_rp in influxdb.downsample.keys() %}
-so_downsample_cq:
+  {% for measurement in influxdb.downsample[dest_rp].measurements %}
+so_downsample_{{measurement}}_cq:
   influxdb_continuous_query.present:
-    - name: so_downsample_cq
+    - name: so_downsample_{{measurement}}_cq
     - database: telegraf
-    - query: SELECT mean(*) INTO "{{dest_rp}}".:MEASUREMENT FROM /.*/ GROUP BY time({{influxdb.downsample[dest_rp].resolution}}),*
+    - query: SELECT mean(*) INTO "{{dest_rp}}"."{{measurement}}" FROM "{{measurement}}" GROUP BY time({{influxdb.downsample[dest_rp].resolution}})
     - ssl: True
     - verify_ssl: /etc/pki/ca.crt
     - cert: ['/etc/pki/influxdb.crt', '/etc/pki/influxdb.key']
@@ -126,7 +127,7 @@ so_downsample_cq:
       - docker_container: so-influxdb
       - influxdb_database: telegraf_database
       - file: influxdb_continuous_query.present_patch
-      - sls: salt.python3-influxdb
+  {% endfor %}
 {% endfor %}
 
 {% endif %}