CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-09 02:32:46 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #11743 from Security-Onion-Solutions/fix/elastic_template_check

Browse Source 
Additional fixes for index template check
This commit is contained in:
Jason Ertel
2023-11-09 00:15:14 -05:00
committed by GitHub
parent 268dc03131 02baa18502
commit 325dceb01b
1 changed files with 15 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
salt/elasticsearch/tools/sbin_jinja/so-elasticsearch-templates-load
View File

@@ -123,9 +123,23 @@ if [ ! -f $STATE_FILE_SUCCESS ]; then
{% else %} {% else %}
pattern="*" pattern="*"
{% endif %} {% endif %}
# Index templates will be skipped if the following conditions are met:
# 1. The template is part of the "so-logs-" template group
# 2. The template name does not correlate to at least one existing component template
# In this situation, the script will treat the skipped template as a temporary failure
# and allow the templates to be loaded again on the next run or highstate, whichever
# comes first.
COMPONENT_LIST=$(so-elasticsearch-component-templates-list)
for i in $pattern; do for i in $pattern; do
TEMPLATE=${i::-14} TEMPLATE=${i::-14}
load_template "_index_template/$TEMPLATE" "$i" COMPONENT_PATTERN=${TEMPLATE:3}
MATCH=$(echo "$TEMPLATE" | grep -E "^so-logs-|^so-metrics" | grep -v osquery)
if [[ -n "$MATCH" && ! "$COMPONENT_LIST" =~ "$COMPONENT_PATTERN" ]]; then
load_failures=$((load_failures+1))
echo "Component template does not exist for $COMPONENT_PATTERN. The index template will not be loaded. Load failures: $load_failures"
else
load_template "_index_template/$TEMPLATE" "$i"
fi
done done
else else
{% if GLOBALS.role == 'so-heavynode' %} {% if GLOBALS.role == 'so-heavynode' %}