CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 17:22:49 +01:00
Code Issues Packages Projects Releases Wiki Activity

Add eligible_indices to index deletion requirements

Browse Source
This commit is contained in:
Wes
2023-05-24 17:02:11 +00:00
parent a308a39bbe
commit 53f258b08f
1 changed files with 12 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
salt/curator/tools/sbin_jinja/so-curator-cluster-delete-delete
View File

@@ -11,14 +11,24 @@
LOG="/opt/so/log/curator/so-curator-cluster-delete.log" LOG="/opt/so/log/curator/so-curator-cluster-delete.log"
LOG_SIZE_LIMIT=$(/usr/sbin/so-elasticsearch-cluster-space-total {{ RETENTION.retention_pct}}) LOG_SIZE_LIMIT=$(/usr/sbin/so-elasticsearch-cluster-space-total {{ RETENTION.retention_pct}})
TODAY=$(date +'%Y.%m.%d)
eligible_indices() {
[[ $(/usr/sbin/so-elasticsearch-query _cat/indices?h=index,status | grep 'open$' | awk '{print $1}' | grep -vE "playbook|so-case|$TODAY" | grep -E "(logstash-|so-|.ds-logs-)" | wc -l) -ge 1 ]]
}
overlimit() { overlimit() {
[[ $(/usr/sbin/so-elasticsearch-cluster-space-used) -gt "${LOG_SIZE_LIMIT}" ]] [[ $(/usr/sbin/so-elasticsearch-cluster-space-used) -gt "${LOG_SIZE_LIMIT}" ]]
} }
# Check to see if Elasticsearch indices using more disk space than LOG_SIZE_LIMIT ###########################
# Check for 2 conditions: #
###########################
# 1. Check if Elasticsearch indices are using more disk space than LOG_SIZE_LIMIT
# 2. Check if Elasticsearch indices are eligible for deletion -- they cannot be Playbook, SOC, today's, or other important indices
# Closed indices will be deleted first. If we are able to bring disk space under LOG_SIZE_LIMIT, we will break out of the loop. # Closed indices will be deleted first. If we are able to bring disk space under LOG_SIZE_LIMIT, we will break out of the loop.
while overlimit; do
while overlimit && eligible_indices; do
# If we can't query Elasticsearch, then immediately return false. # If we can't query Elasticsearch, then immediately return false.
/usr/sbin/so-elasticsearch-query _cat/indices?h=index,status > /dev/null 2>&1 /usr/sbin/so-elasticsearch-query _cat/indices?h=index,status > /dev/null 2>&1
[ $? -eq 1 ] && echo "$(date) - Could not query Elasticsearch." >> ${LOG} && exit [ $? -eq 1 ] && echo "$(date) - Could not query Elasticsearch." >> ${LOG} && exit