From 6d25151ab8dc1dbe5af05a1fdb1a3f5dc72a4991 Mon Sep 17 00:00:00 2001 From: Wes Lambert Date: Wed, 17 Jun 2020 18:59:13 +0000 Subject: [PATCH] Basic index read-only attr removal script --- .../tools/sbin/so-elasticsearch-indices-rw | 26 +++++++++++++++++++ 1 file changed, 26 insertions(+) create mode 100644 salt/common/tools/sbin/so-elasticsearch-indices-rw diff --git a/salt/common/tools/sbin/so-elasticsearch-indices-rw b/salt/common/tools/sbin/so-elasticsearch-indices-rw new file mode 100644 index 000000000..acc46ff0d --- /dev/null +++ b/salt/common/tools/sbin/so-elasticsearch-indices-rw @@ -0,0 +1,26 @@ +#!/bin/bash +# +# +# Copyright 2014,2015,2016,2017,2018,2019,2020 Security Onion Solutions, LLC +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see . +IP={{ salt['grains.get']('ip_interfaces').get(salt['pillar.get']('sensor:mainint', salt['pillar.get']('master:mainint', salt['pillar.get']('node:mainint', salt['pillar.get']('host:mainint')))))[0] }} +ESPORT=9200 +THEHIVEESPORT=9400 + +echo "Removing read only attributes for indices..." +echo +for p in $ESPORT $THEHIVEESPORT; do + curl -XPUT -H "Content-Type: application/json" http://$IP:$p/_all/_settings -d '{"index.blocks.read_only_allow_delete": null}' 2>&1 | if grep -q ack; then echo "Index settings updated..."; else echo "There was any issue updating the read-only attribute. Please ensure Elasticsearch is running.";fi; +done