mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2025-12-06 17:22:49 +01:00
Add Curator action files for EG indices
This commit is contained in:
29
salt/curator/files/action/so-endgame-close.yml
Normal file
29
salt/curator/files/action/so-endgame-close.yml
Normal file
@@ -0,0 +1,29 @@
|
|||||||
|
{%- set cur_close_days = salt['pillar.get']('elasticsearch:index_settings:so-endgame:close', 30) -%}
|
||||||
|
---
|
||||||
|
# Remember, leave a key empty if there is no value. None will be a string,
|
||||||
|
# not a Python "NoneType"
|
||||||
|
#
|
||||||
|
# Also remember that all examples have 'disable_action' set to True. If you
|
||||||
|
# want to use this action as a template, be sure to set this to False after
|
||||||
|
# copying it.
|
||||||
|
actions:
|
||||||
|
1:
|
||||||
|
action: close
|
||||||
|
description: >-
|
||||||
|
Close Endgame indices older than {{cur_close_days}} days.
|
||||||
|
options:
|
||||||
|
delete_aliases: False
|
||||||
|
timeout_override:
|
||||||
|
continue_if_exception: False
|
||||||
|
disable_action: False
|
||||||
|
filters:
|
||||||
|
- filtertype: pattern
|
||||||
|
kind: regex
|
||||||
|
value: '^(logstash-endgame.*|so-endgame.*|endgame.*)$'
|
||||||
|
- filtertype: age
|
||||||
|
source: name
|
||||||
|
direction: older
|
||||||
|
timestring: '%Y.%m.%d'
|
||||||
|
unit: days
|
||||||
|
unit_count: {{cur_close_days}}
|
||||||
|
exclude:
|
||||||
29
salt/curator/files/action/so-endgame-delete.yml
Normal file
29
salt/curator/files/action/so-endgame-delete.yml
Normal file
@@ -0,0 +1,29 @@
|
|||||||
|
{%- set DELETE_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-endgame:delete', 365) -%}
|
||||||
|
---
|
||||||
|
# Remember, leave a key empty if there is no value. None will be a string,
|
||||||
|
# not a Python "NoneType"
|
||||||
|
#
|
||||||
|
# Also remember that all examples have 'disable_action' set to True. If you
|
||||||
|
# want to use this action as a template, be sure to set this to False after
|
||||||
|
# copying it.
|
||||||
|
actions:
|
||||||
|
1:
|
||||||
|
action: delete_indices
|
||||||
|
description: >-
|
||||||
|
Delete Endgame indices when older than {{ DELETE_DAYS }} days.
|
||||||
|
options:
|
||||||
|
ignore_empty_list: True
|
||||||
|
disable_action: False
|
||||||
|
filters:
|
||||||
|
- filtertype: pattern
|
||||||
|
kind: regex
|
||||||
|
value: '^(logstash-endgame.*|so-endgame.*|endgame.*)$'
|
||||||
|
- filtertype: age
|
||||||
|
source: name
|
||||||
|
direction: older
|
||||||
|
timestring: '%Y.%m.%d'
|
||||||
|
unit: days
|
||||||
|
unit_count: {{ DELETE_DAYS }}
|
||||||
|
exclude:
|
||||||
|
|
||||||
|
|
||||||
24
salt/curator/files/action/so-endgame-warm.yml
Normal file
24
salt/curator/files/action/so-endgame-warm.yml
Normal file
@@ -0,0 +1,24 @@
|
|||||||
|
{%- set WARM_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-endgame:warm', 7) -%}
|
||||||
|
actions:
|
||||||
|
1:
|
||||||
|
action: allocation
|
||||||
|
description: "Apply shard allocation filtering rules to the specified indices"
|
||||||
|
options:
|
||||||
|
key: box_type
|
||||||
|
value: warm
|
||||||
|
allocation_type: require
|
||||||
|
wait_for_completion: true
|
||||||
|
timeout_override:
|
||||||
|
continue_if_exception: false
|
||||||
|
disable_action: false
|
||||||
|
filters:
|
||||||
|
- filtertype: pattern
|
||||||
|
kind: regex
|
||||||
|
value: '^(logstash-endgame.*|so-endgame.*|endgame.*)$'
|
||||||
|
- filtertype: age
|
||||||
|
source: name
|
||||||
|
direction: older
|
||||||
|
timestring: '%Y.%m.%d'
|
||||||
|
unit: days
|
||||||
|
unit_count: {{ WARM_DAYS }}
|
||||||
|
|
||||||
Reference in New Issue
Block a user