mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2025-12-23 17:33:10 +01:00
Merge branch 'dev' into kilo
This commit is contained in:
Jason Ertel
@@ -17,4 +17,4 @@
|
||||
|
||||
. /usr/sbin/so-common
|
||||
|
||||
salt-call state.highstate -linfo
|
||||
salt-call state.highstate -l info
|
||||
|
||||
@@ -105,17 +105,20 @@ add_common() {
|
||||
|
||||
airgap_mounted() {
|
||||
# Let's see if the ISO is already mounted.
|
||||
if [ -f /tmp/soagupdate/SecurityOnion/VERSION ]; then
|
||||
if [[ -f /tmp/soagupdate/SecurityOnion/VERSION ]]; then
|
||||
echo "The ISO is already mounted"
|
||||
else
|
||||
echo ""
|
||||
cat << EOF
|
||||
if [[ -z $ISOLOC ]]; then
|
||||
echo "This is airgap. Ask for a location."
|
||||
echo ""
|
||||
cat << EOF
|
||||
In order for soup to proceed, the path to the downloaded Security Onion ISO file, or the path to the CD-ROM or equivalent device containing the ISO media must be provided.
|
||||
For example, if you have copied the new Security Onion ISO file to your home directory, then the path might look like /home/myuser/securityonion-2.x.y.iso.
|
||||
Or, if you have burned the new ISO onto an optical disk then the path might look like /dev/cdrom.
|
||||
|
||||
EOF
|
||||
read -rp 'Enter the path to the new Security Onion ISO content: ' ISOLOC
|
||||
read -rp 'Enter the path to the new Security Onion ISO content: ' ISOLOC
|
||||
fi
|
||||
if [[ -f $ISOLOC ]]; then
|
||||
# Mounting the ISO image
|
||||
mkdir -p /tmp/soagupdate
|
||||
@@ -131,7 +134,7 @@ EOF
|
||||
elif [[ -f $ISOLOC/SecurityOnion/VERSION ]]; then
|
||||
ln -s $ISOLOC /tmp/soagupdate
|
||||
echo "Found the update content"
|
||||
else
|
||||
elif [[ -b $ISOLOC ]]; then
|
||||
mkdir -p /tmp/soagupdate
|
||||
mount $ISOLOC /tmp/soagupdate
|
||||
if [ ! -f /tmp/soagupdate/SecurityOnion/VERSION ]; then
|
||||
@@ -140,7 +143,11 @@ EOF
|
||||
exit 0
|
||||
else
|
||||
echo "Device has been mounted!"
|
||||
fi
|
||||
fi
|
||||
else
|
||||
echo "Could not find Security Onion ISO content at ${ISOLOC}"
|
||||
echo "Ensure the path you entered is correct, and that you verify the ISO that you downloaded."
|
||||
exit 0
|
||||
fi
|
||||
fi
|
||||
}
|
||||
@@ -150,7 +157,7 @@ airgap_update_dockers() {
|
||||
# Let's copy the tarball
|
||||
if [[ ! -f $AGDOCKER/registry.tar ]]; then
|
||||
echo "Unable to locate registry. Exiting"
|
||||
exit 1
|
||||
exit 0
|
||||
else
|
||||
echo "Stopping the registry docker"
|
||||
docker stop so-dockerregistry
|
||||
@@ -624,7 +631,7 @@ upgrade_space() {
|
||||
clean_dockers
|
||||
if ! verify_upgradespace; then
|
||||
echo "There is not enough space to perform the upgrade. Please free up space and try again"
|
||||
exit 1
|
||||
exit 0
|
||||
fi
|
||||
else
|
||||
echo "You have enough space for upgrade. Proceeding with soup."
|
||||
@@ -774,39 +781,23 @@ verify_latest_update_script() {
|
||||
}
|
||||
|
||||
main() {
|
||||
set -e
|
||||
set +e
|
||||
trap 'check_err $?' EXIT
|
||||
|
||||
echo "### Preparing soup at $(date) ###"
|
||||
while getopts ":b" opt; do
|
||||
case "$opt" in
|
||||
b ) # process option b
|
||||
shift
|
||||
BATCHSIZE=$1
|
||||
if ! [[ "$BATCHSIZE" =~ ^[0-9]+$ ]]; then
|
||||
echo "Batch size must be a number greater than 0."
|
||||
exit 1
|
||||
fi
|
||||
;;
|
||||
\? )
|
||||
echo "Usage: cmd [-b]"
|
||||
;;
|
||||
esac
|
||||
done
|
||||
|
||||
echo "Checking to see if this is an airgap install."
|
||||
echo ""
|
||||
check_airgap
|
||||
if [[ $is_airgap -eq 0 && $UNATTENDED == true && -z $ISOLOC ]]; then
|
||||
echo "Missing file argument for unattended airgap upgrade."
|
||||
exit 0
|
||||
fi
|
||||
echo "Checking to see if this is a manager."
|
||||
echo ""
|
||||
require_manager
|
||||
set_minionid
|
||||
echo "Checking to see if this is an airgap install."
|
||||
echo ""
|
||||
check_airgap
|
||||
echo "Found that Security Onion $INSTALLEDVERSION is currently installed."
|
||||
echo ""
|
||||
if [[ $is_airgap -eq 0 ]]; then
|
||||
# Let's mount the ISO since this is airgap
|
||||
echo "This is airgap. Ask for a location."
|
||||
airgap_mounted
|
||||
else
|
||||
echo "Cloning Security Onion github repo into $UPDATE_DIR."
|
||||
@@ -894,7 +885,7 @@ main() {
|
||||
echo "Once the issue is resolved, run soup again."
|
||||
echo "Exiting."
|
||||
echo ""
|
||||
exit 1
|
||||
exit 0
|
||||
else
|
||||
echo "Salt upgrade success."
|
||||
echo ""
|
||||
@@ -1029,7 +1020,40 @@ EOF
|
||||
echo "### soup has been served at $(date) ###"
|
||||
}
|
||||
|
||||
cat << EOF
|
||||
while getopts ":b:f:y" opt; do
|
||||
case ${opt} in
|
||||
b )
|
||||
BATCHSIZE="$OPTARG"
|
||||
if ! [[ "$BATCHSIZE" =~ ^[1-9][0-9]*$ ]]; then
|
||||
echo "Batch size must be a number greater than 0."
|
||||
exit 1
|
||||
fi
|
||||
;;
|
||||
y )
|
||||
if [[ ! -f /opt/so/state/yeselastic.txt ]]; then
|
||||
echo "Cannot run soup in unattended mode. You must run soup manually to accept the Elastic License."
|
||||
exit 1
|
||||
else
|
||||
UNATTENDED=true
|
||||
fi
|
||||
;;
|
||||
f )
|
||||
ISOLOC="$OPTARG"
|
||||
;;
|
||||
\? )
|
||||
echo "Usage: soup [-b] [-y] [-f <iso location>]"
|
||||
exit 1
|
||||
;;
|
||||
: )
|
||||
echo "Invalid option: $OPTARG requires an argument"
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
done
|
||||
shift $((OPTIND - 1))
|
||||
|
||||
if [[ -z $UNATTENDED ]]; then
|
||||
cat << EOF
|
||||
|
||||
SOUP - Security Onion UPdater
|
||||
|
||||
@@ -1041,7 +1065,9 @@ Press Enter to continue or Ctrl-C to cancel.
|
||||
|
||||
EOF
|
||||
|
||||
read -r input
|
||||
read -r input
|
||||
fi
|
||||
|
||||
echo "### Preparing soup at $(date) ###"
|
||||
main "$@" | tee -a $SOUP_LOG
|
||||
|
||||
|
||||
29
salt/curator/files/action/so-aws-close.yml
Normal file
29
salt/curator/files/action/so-aws-close.yml
Normal file
@@ -0,0 +1,29 @@
|
||||
{%- set cur_close_days = salt['pillar.get']('elasticsearch:index_settings:so-aws:close', 30) -%}
|
||||
---
|
||||
# Remember, leave a key empty if there is no value. None will be a string,
|
||||
# not a Python "NoneType"
|
||||
#
|
||||
# Also remember that all examples have 'disable_action' set to True. If you
|
||||
# want to use this action as a template, be sure to set this to False after
|
||||
# copying it.
|
||||
actions:
|
||||
1:
|
||||
action: close
|
||||
description: >-
|
||||
Close aws indices older than {{cur_close_days}} days.
|
||||
options:
|
||||
delete_aliases: False
|
||||
timeout_override:
|
||||
continue_if_exception: False
|
||||
disable_action: False
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: regex
|
||||
value: '^(logstash-aws.*|so-aws.*)$'
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{cur_close_days}}
|
||||
exclude:
|
||||
29
salt/curator/files/action/so-aws-delete.yml
Normal file
29
salt/curator/files/action/so-aws-delete.yml
Normal file
@@ -0,0 +1,29 @@
|
||||
{%- set DELETE_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-aws:delete', 365) -%}
|
||||
---
|
||||
# Remember, leave a key empty if there is no value. None will be a string,
|
||||
# not a Python "NoneType"
|
||||
#
|
||||
# Also remember that all examples have 'disable_action' set to True. If you
|
||||
# want to use this action as a template, be sure to set this to False after
|
||||
# copying it.
|
||||
actions:
|
||||
1:
|
||||
action: delete_indices
|
||||
description: >-
|
||||
Delete aws indices when older than {{ DELETE_DAYS }} days.
|
||||
options:
|
||||
ignore_empty_list: True
|
||||
disable_action: False
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: regex
|
||||
value: '^(logstash-aws.*|so-aws.*)$'
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{ DELETE_DAYS }}
|
||||
exclude:
|
||||
|
||||
|
||||
24
salt/curator/files/action/so-aws-warm.yml
Normal file
24
salt/curator/files/action/so-aws-warm.yml
Normal file
@@ -0,0 +1,24 @@
|
||||
{%- set WARM_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-aws:warm', 7) -%}
|
||||
actions:
|
||||
1:
|
||||
action: allocation
|
||||
description: "Apply shard allocation filtering rules to the specified indices"
|
||||
options:
|
||||
key: box_type
|
||||
value: warm
|
||||
allocation_type: require
|
||||
wait_for_completion: true
|
||||
timeout_override:
|
||||
continue_if_exception: false
|
||||
disable_action: false
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: prefix
|
||||
value: so-aws
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{ WARM_DAYS }}
|
||||
|
||||
29
salt/curator/files/action/so-azure-close.yml
Normal file
29
salt/curator/files/action/so-azure-close.yml
Normal file
@@ -0,0 +1,29 @@
|
||||
{%- set cur_close_days = salt['pillar.get']('elasticsearch:index_settings:so-azure:close', 30) -%}
|
||||
---
|
||||
# Remember, leave a key empty if there is no value. None will be a string,
|
||||
# not a Python "NoneType"
|
||||
#
|
||||
# Also remember that all examples have 'disable_action' set to True. If you
|
||||
# want to use this action as a template, be sure to set this to False after
|
||||
# copying it.
|
||||
actions:
|
||||
1:
|
||||
action: close
|
||||
description: >-
|
||||
Close azure indices older than {{cur_close_days}} days.
|
||||
options:
|
||||
delete_aliases: False
|
||||
timeout_override:
|
||||
continue_if_exception: False
|
||||
disable_action: False
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: regex
|
||||
value: '^(logstash-azure.*|so-azure.*)$'
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{cur_close_days}}
|
||||
exclude:
|
||||
29
salt/curator/files/action/so-azure-delete.yml
Normal file
29
salt/curator/files/action/so-azure-delete.yml
Normal file
@@ -0,0 +1,29 @@
|
||||
{%- set DELETE_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-azure:delete', 365) -%}
|
||||
---
|
||||
# Remember, leave a key empty if there is no value. None will be a string,
|
||||
# not a Python "NoneType"
|
||||
#
|
||||
# Also remember that all examples have 'disable_action' set to True. If you
|
||||
# want to use this action as a template, be sure to set this to False after
|
||||
# copying it.
|
||||
actions:
|
||||
1:
|
||||
action: delete_indices
|
||||
description: >-
|
||||
Delete azure indices when older than {{ DELETE_DAYS }} days.
|
||||
options:
|
||||
ignore_empty_list: True
|
||||
disable_action: False
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: regex
|
||||
value: '^(logstash-azure.*|so-azure.*)$'
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{ DELETE_DAYS }}
|
||||
exclude:
|
||||
|
||||
|
||||
24
salt/curator/files/action/so-azure-warm.yml
Normal file
24
salt/curator/files/action/so-azure-warm.yml
Normal file
@@ -0,0 +1,24 @@
|
||||
{%- set WARM_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-azure:warm', 7) -%}
|
||||
actions:
|
||||
1:
|
||||
action: allocation
|
||||
description: "Apply shard allocation filtering rules to the specified indices"
|
||||
options:
|
||||
key: box_type
|
||||
value: warm
|
||||
allocation_type: require
|
||||
wait_for_completion: true
|
||||
timeout_override:
|
||||
continue_if_exception: false
|
||||
disable_action: false
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: prefix
|
||||
value: so-azure
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{ WARM_DAYS }}
|
||||
|
||||
29
salt/curator/files/action/so-barracuda-close.yml
Normal file
29
salt/curator/files/action/so-barracuda-close.yml
Normal file
@@ -0,0 +1,29 @@
|
||||
{%- set cur_close_days = salt['pillar.get']('elasticsearch:index_settings:so-barracuda:close', 30) -%}
|
||||
---
|
||||
# Remember, leave a key empty if there is no value. None will be a string,
|
||||
# not a Python "NoneType"
|
||||
#
|
||||
# Also remember that all examples have 'disable_action' set to True. If you
|
||||
# want to use this action as a template, be sure to set this to False after
|
||||
# copying it.
|
||||
actions:
|
||||
1:
|
||||
action: close
|
||||
description: >-
|
||||
Close barracuda indices older than {{cur_close_days}} days.
|
||||
options:
|
||||
delete_aliases: False
|
||||
timeout_override:
|
||||
continue_if_exception: False
|
||||
disable_action: False
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: regex
|
||||
value: '^(logstash-barracuda.*|so-barracuda.*)$'
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{cur_close_days}}
|
||||
exclude:
|
||||
29
salt/curator/files/action/so-barracuda-delete.yml
Normal file
29
salt/curator/files/action/so-barracuda-delete.yml
Normal file
@@ -0,0 +1,29 @@
|
||||
{%- set DELETE_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-barracuda:delete', 365) -%}
|
||||
---
|
||||
# Remember, leave a key empty if there is no value. None will be a string,
|
||||
# not a Python "NoneType"
|
||||
#
|
||||
# Also remember that all examples have 'disable_action' set to True. If you
|
||||
# want to use this action as a template, be sure to set this to False after
|
||||
# copying it.
|
||||
actions:
|
||||
1:
|
||||
action: delete_indices
|
||||
description: >-
|
||||
Delete barracuda indices when older than {{ DELETE_DAYS }} days.
|
||||
options:
|
||||
ignore_empty_list: True
|
||||
disable_action: False
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: regex
|
||||
value: '^(logstash-barracuda.*|so-barracuda.*)$'
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{ DELETE_DAYS }}
|
||||
exclude:
|
||||
|
||||
|
||||
24
salt/curator/files/action/so-barracuda-warm.yml
Normal file
24
salt/curator/files/action/so-barracuda-warm.yml
Normal file
@@ -0,0 +1,24 @@
|
||||
{%- set WARM_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-barracuda:warm', 7) -%}
|
||||
actions:
|
||||
1:
|
||||
action: allocation
|
||||
description: "Apply shard allocation filtering rules to the specified indices"
|
||||
options:
|
||||
key: box_type
|
||||
value: warm
|
||||
allocation_type: require
|
||||
wait_for_completion: true
|
||||
timeout_override:
|
||||
continue_if_exception: false
|
||||
disable_action: false
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: prefix
|
||||
value: so-barracuda
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{ WARM_DAYS }}
|
||||
|
||||
29
salt/curator/files/action/so-beats-delete.yml
Normal file
29
salt/curator/files/action/so-beats-delete.yml
Normal file
@@ -0,0 +1,29 @@
|
||||
{%- set DELETE_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-beats:delete', 365) -%}
|
||||
---
|
||||
# Remember, leave a key empty if there is no value. None will be a string,
|
||||
# not a Python "NoneType"
|
||||
#
|
||||
# Also remember that all examples have 'disable_action' set to True. If you
|
||||
# want to use this action as a template, be sure to set this to False after
|
||||
# copying it.
|
||||
actions:
|
||||
1:
|
||||
action: delete_indices
|
||||
description: >-
|
||||
Delete beats indices when older than {{ DELETE_DAYS }} days.
|
||||
options:
|
||||
ignore_empty_list: True
|
||||
disable_action: False
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: regex
|
||||
value: '^(logstash-beats.*|so-beats.*)$'
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{ DELETE_DAYS }}
|
||||
exclude:
|
||||
|
||||
|
||||
24
salt/curator/files/action/so-beats-warm.yml
Normal file
24
salt/curator/files/action/so-beats-warm.yml
Normal file
@@ -0,0 +1,24 @@
|
||||
{%- set WARM_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-beats:warm', 7) -%}
|
||||
actions:
|
||||
1:
|
||||
action: allocation
|
||||
description: "Apply shard allocation filtering rules to the specified indices"
|
||||
options:
|
||||
key: box_type
|
||||
value: warm
|
||||
allocation_type: require
|
||||
wait_for_completion: true
|
||||
timeout_override:
|
||||
continue_if_exception: false
|
||||
disable_action: false
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: prefix
|
||||
value: so-beats
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{ WARM_DAYS }}
|
||||
|
||||
29
salt/curator/files/action/so-bluecoat-close.yml
Normal file
29
salt/curator/files/action/so-bluecoat-close.yml
Normal file
@@ -0,0 +1,29 @@
|
||||
{%- set cur_close_days = salt['pillar.get']('elasticsearch:index_settings:so-bluecoat:close', 30) -%}
|
||||
---
|
||||
# Remember, leave a key empty if there is no value. None will be a string,
|
||||
# not a Python "NoneType"
|
||||
#
|
||||
# Also remember that all examples have 'disable_action' set to True. If you
|
||||
# want to use this action as a template, be sure to set this to False after
|
||||
# copying it.
|
||||
actions:
|
||||
1:
|
||||
action: close
|
||||
description: >-
|
||||
Close bluecoat indices older than {{cur_close_days}} days.
|
||||
options:
|
||||
delete_aliases: False
|
||||
timeout_override:
|
||||
continue_if_exception: False
|
||||
disable_action: False
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: regex
|
||||
value: '^(logstash-bluecoat.*|so-bluecoat.*)$'
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{cur_close_days}}
|
||||
exclude:
|
||||
29
salt/curator/files/action/so-bluecoat-delete.yml
Normal file
29
salt/curator/files/action/so-bluecoat-delete.yml
Normal file
@@ -0,0 +1,29 @@
|
||||
{%- set DELETE_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-bluecoat:delete', 365) -%}
|
||||
---
|
||||
# Remember, leave a key empty if there is no value. None will be a string,
|
||||
# not a Python "NoneType"
|
||||
#
|
||||
# Also remember that all examples have 'disable_action' set to True. If you
|
||||
# want to use this action as a template, be sure to set this to False after
|
||||
# copying it.
|
||||
actions:
|
||||
1:
|
||||
action: delete_indices
|
||||
description: >-
|
||||
Delete bluecoat indices when older than {{ DELETE_DAYS }} days.
|
||||
options:
|
||||
ignore_empty_list: True
|
||||
disable_action: False
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: regex
|
||||
value: '^(logstash-bluecoat.*|so-bluecoat.*)$'
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{ DELETE_DAYS }}
|
||||
exclude:
|
||||
|
||||
|
||||
24
salt/curator/files/action/so-bluecoat-warm.yml
Normal file
24
salt/curator/files/action/so-bluecoat-warm.yml
Normal file
@@ -0,0 +1,24 @@
|
||||
{%- set WARM_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-bluecoat:warm', 7) -%}
|
||||
actions:
|
||||
1:
|
||||
action: allocation
|
||||
description: "Apply shard allocation filtering rules to the specified indices"
|
||||
options:
|
||||
key: box_type
|
||||
value: warm
|
||||
allocation_type: require
|
||||
wait_for_completion: true
|
||||
timeout_override:
|
||||
continue_if_exception: false
|
||||
disable_action: false
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: prefix
|
||||
value: so-bluecoat
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{ WARM_DAYS }}
|
||||
|
||||
29
salt/curator/files/action/so-cef-close.yml
Normal file
29
salt/curator/files/action/so-cef-close.yml
Normal file
@@ -0,0 +1,29 @@
|
||||
{%- set cur_close_days = salt['pillar.get']('elasticsearch:index_settings:so-cef:close', 30) -%}
|
||||
---
|
||||
# Remember, leave a key empty if there is no value. None will be a string,
|
||||
# not a Python "NoneType"
|
||||
#
|
||||
# Also remember that all examples have 'disable_action' set to True. If you
|
||||
# want to use this action as a template, be sure to set this to False after
|
||||
# copying it.
|
||||
actions:
|
||||
1:
|
||||
action: close
|
||||
description: >-
|
||||
Close cef indices older than {{cur_close_days}} days.
|
||||
options:
|
||||
delete_aliases: False
|
||||
timeout_override:
|
||||
continue_if_exception: False
|
||||
disable_action: False
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: regex
|
||||
value: '^(logstash-cef.*|so-cef.*)$'
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{cur_close_days}}
|
||||
exclude:
|
||||
29
salt/curator/files/action/so-cef-delete.yml
Normal file
29
salt/curator/files/action/so-cef-delete.yml
Normal file
@@ -0,0 +1,29 @@
|
||||
{%- set DELETE_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-cef:delete', 365) -%}
|
||||
---
|
||||
# Remember, leave a key empty if there is no value. None will be a string,
|
||||
# not a Python "NoneType"
|
||||
#
|
||||
# Also remember that all examples have 'disable_action' set to True. If you
|
||||
# want to use this action as a template, be sure to set this to False after
|
||||
# copying it.
|
||||
actions:
|
||||
1:
|
||||
action: delete_indices
|
||||
description: >-
|
||||
Delete cef indices when older than {{ DELETE_DAYS }} days.
|
||||
options:
|
||||
ignore_empty_list: True
|
||||
disable_action: False
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: regex
|
||||
value: '^(logstash-cef.*|so-cef.*)$'
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{ DELETE_DAYS }}
|
||||
exclude:
|
||||
|
||||
|
||||
24
salt/curator/files/action/so-cef-warm.yml
Normal file
24
salt/curator/files/action/so-cef-warm.yml
Normal file
@@ -0,0 +1,24 @@
|
||||
{%- set WARM_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-cef:warm', 7) -%}
|
||||
actions:
|
||||
1:
|
||||
action: allocation
|
||||
description: "Apply shard allocation filtering rules to the specified indices"
|
||||
options:
|
||||
key: box_type
|
||||
value: warm
|
||||
allocation_type: require
|
||||
wait_for_completion: true
|
||||
timeout_override:
|
||||
continue_if_exception: false
|
||||
disable_action: false
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: prefix
|
||||
value: so-cef
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{ WARM_DAYS }}
|
||||
|
||||
29
salt/curator/files/action/so-checkpoint-close.yml
Normal file
29
salt/curator/files/action/so-checkpoint-close.yml
Normal file
@@ -0,0 +1,29 @@
|
||||
{%- set cur_close_days = salt['pillar.get']('elasticsearch:index_settings:so-checkpoint:close', 30) -%}
|
||||
---
|
||||
# Remember, leave a key empty if there is no value. None will be a string,
|
||||
# not a Python "NoneType"
|
||||
#
|
||||
# Also remember that all examples have 'disable_action' set to True. If you
|
||||
# want to use this action as a template, be sure to set this to False after
|
||||
# copying it.
|
||||
actions:
|
||||
1:
|
||||
action: close
|
||||
description: >-
|
||||
Close checkpoint indices older than {{cur_close_days}} days.
|
||||
options:
|
||||
delete_aliases: False
|
||||
timeout_override:
|
||||
continue_if_exception: False
|
||||
disable_action: False
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: regex
|
||||
value: '^(logstash-checkpoint.*|so-checkpoint.*)$'
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{cur_close_days}}
|
||||
exclude:
|
||||
29
salt/curator/files/action/so-checkpoint-delete.yml
Normal file
29
salt/curator/files/action/so-checkpoint-delete.yml
Normal file
@@ -0,0 +1,29 @@
|
||||
{%- set DELETE_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-checkpoint:delete', 365) -%}
|
||||
---
|
||||
# Remember, leave a key empty if there is no value. None will be a string,
|
||||
# not a Python "NoneType"
|
||||
#
|
||||
# Also remember that all examples have 'disable_action' set to True. If you
|
||||
# want to use this action as a template, be sure to set this to False after
|
||||
# copying it.
|
||||
actions:
|
||||
1:
|
||||
action: delete_indices
|
||||
description: >-
|
||||
Delete checkpoint indices when older than {{ DELETE_DAYS }} days.
|
||||
options:
|
||||
ignore_empty_list: True
|
||||
disable_action: False
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: regex
|
||||
value: '^(logstash-checkpoint.*|so-checkpoint.*)$'
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{ DELETE_DAYS }}
|
||||
exclude:
|
||||
|
||||
|
||||
24
salt/curator/files/action/so-checkpoint-warm.yml
Normal file
24
salt/curator/files/action/so-checkpoint-warm.yml
Normal file
@@ -0,0 +1,24 @@
|
||||
{%- set WARM_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-checkpoint:warm', 7) -%}
|
||||
actions:
|
||||
1:
|
||||
action: allocation
|
||||
description: "Apply shard allocation filtering rules to the specified indices"
|
||||
options:
|
||||
key: box_type
|
||||
value: warm
|
||||
allocation_type: require
|
||||
wait_for_completion: true
|
||||
timeout_override:
|
||||
continue_if_exception: false
|
||||
disable_action: false
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: prefix
|
||||
value: so-checkpoint
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{ WARM_DAYS }}
|
||||
|
||||
29
salt/curator/files/action/so-cisco-close.yml
Normal file
29
salt/curator/files/action/so-cisco-close.yml
Normal file
@@ -0,0 +1,29 @@
|
||||
{%- set cur_close_days = salt['pillar.get']('elasticsearch:index_settings:so-cisco:close', 30) -%}
|
||||
---
|
||||
# Remember, leave a key empty if there is no value. None will be a string,
|
||||
# not a Python "NoneType"
|
||||
#
|
||||
# Also remember that all examples have 'disable_action' set to True. If you
|
||||
# want to use this action as a template, be sure to set this to False after
|
||||
# copying it.
|
||||
actions:
|
||||
1:
|
||||
action: close
|
||||
description: >-
|
||||
Close cisco indices older than {{cur_close_days}} days.
|
||||
options:
|
||||
delete_aliases: False
|
||||
timeout_override:
|
||||
continue_if_exception: False
|
||||
disable_action: False
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: regex
|
||||
value: '^(logstash-cisco.*|so-cisco.*)$'
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{cur_close_days}}
|
||||
exclude:
|
||||
29
salt/curator/files/action/so-cisco-delete.yml
Normal file
29
salt/curator/files/action/so-cisco-delete.yml
Normal file
@@ -0,0 +1,29 @@
|
||||
{%- set DELETE_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-cisco:delete', 365) -%}
|
||||
---
|
||||
# Remember, leave a key empty if there is no value. None will be a string,
|
||||
# not a Python "NoneType"
|
||||
#
|
||||
# Also remember that all examples have 'disable_action' set to True. If you
|
||||
# want to use this action as a template, be sure to set this to False after
|
||||
# copying it.
|
||||
actions:
|
||||
1:
|
||||
action: delete_indices
|
||||
description: >-
|
||||
Delete cisco indices when older than {{ DELETE_DAYS }} days.
|
||||
options:
|
||||
ignore_empty_list: True
|
||||
disable_action: False
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: regex
|
||||
value: '^(logstash-cisco.*|so-cisco.*)$'
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{ DELETE_DAYS }}
|
||||
exclude:
|
||||
|
||||
|
||||
24
salt/curator/files/action/so-cisco-warm.yml
Normal file
24
salt/curator/files/action/so-cisco-warm.yml
Normal file
@@ -0,0 +1,24 @@
|
||||
{%- set WARM_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-cisco:warm', 7) -%}
|
||||
actions:
|
||||
1:
|
||||
action: allocation
|
||||
description: "Apply shard allocation filtering rules to the specified indices"
|
||||
options:
|
||||
key: box_type
|
||||
value: warm
|
||||
allocation_type: require
|
||||
wait_for_completion: true
|
||||
timeout_override:
|
||||
continue_if_exception: false
|
||||
disable_action: false
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: prefix
|
||||
value: so-cisco
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{ WARM_DAYS }}
|
||||
|
||||
29
salt/curator/files/action/so-cyberark-close.yml
Normal file
29
salt/curator/files/action/so-cyberark-close.yml
Normal file
@@ -0,0 +1,29 @@
|
||||
{%- set cur_close_days = salt['pillar.get']('elasticsearch:index_settings:so-cyberark:close', 30) -%}
|
||||
---
|
||||
# Remember, leave a key empty if there is no value. None will be a string,
|
||||
# not a Python "NoneType"
|
||||
#
|
||||
# Also remember that all examples have 'disable_action' set to True. If you
|
||||
# want to use this action as a template, be sure to set this to False after
|
||||
# copying it.
|
||||
actions:
|
||||
1:
|
||||
action: close
|
||||
description: >-
|
||||
Close cyberark indices older than {{cur_close_days}} days.
|
||||
options:
|
||||
delete_aliases: False
|
||||
timeout_override:
|
||||
continue_if_exception: False
|
||||
disable_action: False
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: regex
|
||||
value: '^(logstash-cyberark.*|so-cyberark.*)$'
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{cur_close_days}}
|
||||
exclude:
|
||||
29
salt/curator/files/action/so-cyberark-delete.yml
Normal file
29
salt/curator/files/action/so-cyberark-delete.yml
Normal file
@@ -0,0 +1,29 @@
|
||||
{%- set DELETE_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-cyberark:delete', 365) -%}
|
||||
---
|
||||
# Remember, leave a key empty if there is no value. None will be a string,
|
||||
# not a Python "NoneType"
|
||||
#
|
||||
# Also remember that all examples have 'disable_action' set to True. If you
|
||||
# want to use this action as a template, be sure to set this to False after
|
||||
# copying it.
|
||||
actions:
|
||||
1:
|
||||
action: delete_indices
|
||||
description: >-
|
||||
Delete cyberark indices when older than {{ DELETE_DAYS }} days.
|
||||
options:
|
||||
ignore_empty_list: True
|
||||
disable_action: False
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: regex
|
||||
value: '^(logstash-cyberark.*|so-cyberark.*)$'
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{ DELETE_DAYS }}
|
||||
exclude:
|
||||
|
||||
|
||||
24
salt/curator/files/action/so-cyberark-warm.yml
Normal file
24
salt/curator/files/action/so-cyberark-warm.yml
Normal file
@@ -0,0 +1,24 @@
|
||||
{%- set WARM_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-cyberark:warm', 7) -%}
|
||||
actions:
|
||||
1:
|
||||
action: allocation
|
||||
description: "Apply shard allocation filtering rules to the specified indices"
|
||||
options:
|
||||
key: box_type
|
||||
value: warm
|
||||
allocation_type: require
|
||||
wait_for_completion: true
|
||||
timeout_override:
|
||||
continue_if_exception: false
|
||||
disable_action: false
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: prefix
|
||||
value: so-cyberark
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{ WARM_DAYS }}
|
||||
|
||||
29
salt/curator/files/action/so-cylance-close.yml
Normal file
29
salt/curator/files/action/so-cylance-close.yml
Normal file
@@ -0,0 +1,29 @@
|
||||
{%- set cur_close_days = salt['pillar.get']('elasticsearch:index_settings:so-cylance:close', 30) -%}
|
||||
---
|
||||
# Remember, leave a key empty if there is no value. None will be a string,
|
||||
# not a Python "NoneType"
|
||||
#
|
||||
# Also remember that all examples have 'disable_action' set to True. If you
|
||||
# want to use this action as a template, be sure to set this to False after
|
||||
# copying it.
|
||||
actions:
|
||||
1:
|
||||
action: close
|
||||
description: >-
|
||||
Close cylance indices older than {{cur_close_days}} days.
|
||||
options:
|
||||
delete_aliases: False
|
||||
timeout_override:
|
||||
continue_if_exception: False
|
||||
disable_action: False
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: regex
|
||||
value: '^(logstash-cylance.*|so-cylance.*)$'
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{cur_close_days}}
|
||||
exclude:
|
||||
29
salt/curator/files/action/so-cylance-delete.yml
Normal file
29
salt/curator/files/action/so-cylance-delete.yml
Normal file
@@ -0,0 +1,29 @@
|
||||
{%- set DELETE_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-cylance:delete', 365) -%}
|
||||
---
|
||||
# Remember, leave a key empty if there is no value. None will be a string,
|
||||
# not a Python "NoneType"
|
||||
#
|
||||
# Also remember that all examples have 'disable_action' set to True. If you
|
||||
# want to use this action as a template, be sure to set this to False after
|
||||
# copying it.
|
||||
actions:
|
||||
1:
|
||||
action: delete_indices
|
||||
description: >-
|
||||
Delete cylance indices when older than {{ DELETE_DAYS }} days.
|
||||
options:
|
||||
ignore_empty_list: True
|
||||
disable_action: False
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: regex
|
||||
value: '^(logstash-cylance.*|so-cylance.*)$'
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{ DELETE_DAYS }}
|
||||
exclude:
|
||||
|
||||
|
||||
24
salt/curator/files/action/so-cylance-warm.yml
Normal file
24
salt/curator/files/action/so-cylance-warm.yml
Normal file
@@ -0,0 +1,24 @@
|
||||
{%- set WARM_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-cylance:warm', 7) -%}
|
||||
actions:
|
||||
1:
|
||||
action: allocation
|
||||
description: "Apply shard allocation filtering rules to the specified indices"
|
||||
options:
|
||||
key: box_type
|
||||
value: warm
|
||||
allocation_type: require
|
||||
wait_for_completion: true
|
||||
timeout_override:
|
||||
continue_if_exception: false
|
||||
disable_action: false
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: prefix
|
||||
value: so-cylance
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{ WARM_DAYS }}
|
||||
|
||||
29
salt/curator/files/action/so-elasticsearch-close.yml
Normal file
29
salt/curator/files/action/so-elasticsearch-close.yml
Normal file
@@ -0,0 +1,29 @@
|
||||
{%- set cur_close_days = salt['pillar.get']('elasticsearch:index_settings:so-elasticsearch:close', 30) -%}
|
||||
---
|
||||
# Remember, leave a key empty if there is no value. None will be a string,
|
||||
# not a Python "NoneType"
|
||||
#
|
||||
# Also remember that all examples have 'disable_action' set to True. If you
|
||||
# want to use this action as a template, be sure to set this to False after
|
||||
# copying it.
|
||||
actions:
|
||||
1:
|
||||
action: close
|
||||
description: >-
|
||||
Close elasticsearch indices older than {{cur_close_days}} days.
|
||||
options:
|
||||
delete_aliases: False
|
||||
timeout_override:
|
||||
continue_if_exception: False
|
||||
disable_action: False
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: regex
|
||||
value: '^(logstash-elasticsearch.*|so-elasticsearch.*)$'
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{cur_close_days}}
|
||||
exclude:
|
||||
29
salt/curator/files/action/so-elasticsearch-delete.yml
Normal file
29
salt/curator/files/action/so-elasticsearch-delete.yml
Normal file
@@ -0,0 +1,29 @@
|
||||
{%- set DELETE_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-elasticsearch:delete', 365) -%}
|
||||
---
|
||||
# Remember, leave a key empty if there is no value. None will be a string,
|
||||
# not a Python "NoneType"
|
||||
#
|
||||
# Also remember that all examples have 'disable_action' set to True. If you
|
||||
# want to use this action as a template, be sure to set this to False after
|
||||
# copying it.
|
||||
actions:
|
||||
1:
|
||||
action: delete_indices
|
||||
description: >-
|
||||
Delete elasticsearch indices when older than {{ DELETE_DAYS }} days.
|
||||
options:
|
||||
ignore_empty_list: True
|
||||
disable_action: False
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: regex
|
||||
value: '^(logstash-elasticsearch.*|so-elasticsearch.*)$'
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{ DELETE_DAYS }}
|
||||
exclude:
|
||||
|
||||
|
||||
24
salt/curator/files/action/so-elasticsearch-warm.yml
Normal file
24
salt/curator/files/action/so-elasticsearch-warm.yml
Normal file
@@ -0,0 +1,24 @@
|
||||
{%- set WARM_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-elasticsearch:warm', 7) -%}
|
||||
actions:
|
||||
1:
|
||||
action: allocation
|
||||
description: "Apply shard allocation filtering rules to the specified indices"
|
||||
options:
|
||||
key: box_type
|
||||
value: warm
|
||||
allocation_type: require
|
||||
wait_for_completion: true
|
||||
timeout_override:
|
||||
continue_if_exception: false
|
||||
disable_action: false
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: prefix
|
||||
value: so-elasticsearch
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{ WARM_DAYS }}
|
||||
|
||||
29
salt/curator/files/action/so-f5-close.yml
Normal file
29
salt/curator/files/action/so-f5-close.yml
Normal file
@@ -0,0 +1,29 @@
|
||||
{%- set cur_close_days = salt['pillar.get']('elasticsearch:index_settings:so-f5:close', 30) -%}
|
||||
---
|
||||
# Remember, leave a key empty if there is no value. None will be a string,
|
||||
# not a Python "NoneType"
|
||||
#
|
||||
# Also remember that all examples have 'disable_action' set to True. If you
|
||||
# want to use this action as a template, be sure to set this to False after
|
||||
# copying it.
|
||||
actions:
|
||||
1:
|
||||
action: close
|
||||
description: >-
|
||||
Close f5 indices older than {{cur_close_days}} days.
|
||||
options:
|
||||
delete_aliases: False
|
||||
timeout_override:
|
||||
continue_if_exception: False
|
||||
disable_action: False
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: regex
|
||||
value: '^(logstash-f5.*|so-f5.*)$'
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{cur_close_days}}
|
||||
exclude:
|
||||
29
salt/curator/files/action/so-f5-delete.yml
Normal file
29
salt/curator/files/action/so-f5-delete.yml
Normal file
@@ -0,0 +1,29 @@
|
||||
{%- set DELETE_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-f5:delete', 365) -%}
|
||||
---
|
||||
# Remember, leave a key empty if there is no value. None will be a string,
|
||||
# not a Python "NoneType"
|
||||
#
|
||||
# Also remember that all examples have 'disable_action' set to True. If you
|
||||
# want to use this action as a template, be sure to set this to False after
|
||||
# copying it.
|
||||
actions:
|
||||
1:
|
||||
action: delete_indices
|
||||
description: >-
|
||||
Delete f5 indices when older than {{ DELETE_DAYS }} days.
|
||||
options:
|
||||
ignore_empty_list: True
|
||||
disable_action: False
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: regex
|
||||
value: '^(logstash-f5.*|so-f5.*)$'
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{ DELETE_DAYS }}
|
||||
exclude:
|
||||
|
||||
|
||||
24
salt/curator/files/action/so-f5-warm.yml
Normal file
24
salt/curator/files/action/so-f5-warm.yml
Normal file
@@ -0,0 +1,24 @@
|
||||
{%- set WARM_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-f5:warm', 7) -%}
|
||||
actions:
|
||||
1:
|
||||
action: allocation
|
||||
description: "Apply shard allocation filtering rules to the specified indices"
|
||||
options:
|
||||
key: box_type
|
||||
value: warm
|
||||
allocation_type: require
|
||||
wait_for_completion: true
|
||||
timeout_override:
|
||||
continue_if_exception: false
|
||||
disable_action: false
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: prefix
|
||||
value: so-f5
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{ WARM_DAYS }}
|
||||
|
||||
29
salt/curator/files/action/so-firewall-delete.yml
Normal file
29
salt/curator/files/action/so-firewall-delete.yml
Normal file
@@ -0,0 +1,29 @@
|
||||
{%- set DELETE_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-firewall:delete', 365) -%}
|
||||
---
|
||||
# Remember, leave a key empty if there is no value. None will be a string,
|
||||
# not a Python "NoneType"
|
||||
#
|
||||
# Also remember that all examples have 'disable_action' set to True. If you
|
||||
# want to use this action as a template, be sure to set this to False after
|
||||
# copying it.
|
||||
actions:
|
||||
1:
|
||||
action: delete_indices
|
||||
description: >-
|
||||
Delete firewall indices when older than {{ DELETE_DAYS }} days.
|
||||
options:
|
||||
ignore_empty_list: True
|
||||
disable_action: False
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: regex
|
||||
value: '^(logstash-firewall.*|so-firewall.*)$'
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{ DELETE_DAYS }}
|
||||
exclude:
|
||||
|
||||
|
||||
24
salt/curator/files/action/so-firewall-warm.yml
Normal file
24
salt/curator/files/action/so-firewall-warm.yml
Normal file
@@ -0,0 +1,24 @@
|
||||
{%- set WARM_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-firewall:warm', 7) -%}
|
||||
actions:
|
||||
1:
|
||||
action: allocation
|
||||
description: "Apply shard allocation filtering rules to the specified indices"
|
||||
options:
|
||||
key: box_type
|
||||
value: warm
|
||||
allocation_type: require
|
||||
wait_for_completion: true
|
||||
timeout_override:
|
||||
continue_if_exception: false
|
||||
disable_action: false
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: prefix
|
||||
value: so-firewall
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{ WARM_DAYS }}
|
||||
|
||||
29
salt/curator/files/action/so-fortinet-close.yml
Normal file
29
salt/curator/files/action/so-fortinet-close.yml
Normal file
@@ -0,0 +1,29 @@
|
||||
{%- set cur_close_days = salt['pillar.get']('elasticsearch:index_settings:so-fortinet:close', 30) -%}
|
||||
---
|
||||
# Remember, leave a key empty if there is no value. None will be a string,
|
||||
# not a Python "NoneType"
|
||||
#
|
||||
# Also remember that all examples have 'disable_action' set to True. If you
|
||||
# want to use this action as a template, be sure to set this to False after
|
||||
# copying it.
|
||||
actions:
|
||||
1:
|
||||
action: close
|
||||
description: >-
|
||||
Close fortinet indices older than {{cur_close_days}} days.
|
||||
options:
|
||||
delete_aliases: False
|
||||
timeout_override:
|
||||
continue_if_exception: False
|
||||
disable_action: False
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: regex
|
||||
value: '^(logstash-fortinet.*|so-fortinet.*)$'
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{cur_close_days}}
|
||||
exclude:
|
||||
29
salt/curator/files/action/so-fortinet-delete.yml
Normal file
29
salt/curator/files/action/so-fortinet-delete.yml
Normal file
@@ -0,0 +1,29 @@
|
||||
{%- set DELETE_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-fortinet:delete', 365) -%}
|
||||
---
|
||||
# Remember, leave a key empty if there is no value. None will be a string,
|
||||
# not a Python "NoneType"
|
||||
#
|
||||
# Also remember that all examples have 'disable_action' set to True. If you
|
||||
# want to use this action as a template, be sure to set this to False after
|
||||
# copying it.
|
||||
actions:
|
||||
1:
|
||||
action: delete_indices
|
||||
description: >-
|
||||
Delete fortinet indices when older than {{ DELETE_DAYS }} days.
|
||||
options:
|
||||
ignore_empty_list: True
|
||||
disable_action: False
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: regex
|
||||
value: '^(logstash-fortinet.*|so-fortinet.*)$'
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{ DELETE_DAYS }}
|
||||
exclude:
|
||||
|
||||
|
||||
24
salt/curator/files/action/so-fortinet-warm.yml
Normal file
24
salt/curator/files/action/so-fortinet-warm.yml
Normal file
@@ -0,0 +1,24 @@
|
||||
{%- set WARM_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-fortinet:warm', 7) -%}
|
||||
actions:
|
||||
1:
|
||||
action: allocation
|
||||
description: "Apply shard allocation filtering rules to the specified indices"
|
||||
options:
|
||||
key: box_type
|
||||
value: warm
|
||||
allocation_type: require
|
||||
wait_for_completion: true
|
||||
timeout_override:
|
||||
continue_if_exception: false
|
||||
disable_action: false
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: prefix
|
||||
value: so-fortinet
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{ WARM_DAYS }}
|
||||
|
||||
29
salt/curator/files/action/so-gcp-close.yml
Normal file
29
salt/curator/files/action/so-gcp-close.yml
Normal file
@@ -0,0 +1,29 @@
|
||||
{%- set cur_close_days = salt['pillar.get']('elasticsearch:index_settings:so-gcp:close', 30) -%}
|
||||
---
|
||||
# Remember, leave a key empty if there is no value. None will be a string,
|
||||
# not a Python "NoneType"
|
||||
#
|
||||
# Also remember that all examples have 'disable_action' set to True. If you
|
||||
# want to use this action as a template, be sure to set this to False after
|
||||
# copying it.
|
||||
actions:
|
||||
1:
|
||||
action: close
|
||||
description: >-
|
||||
Close gcp indices older than {{cur_close_days}} days.
|
||||
options:
|
||||
delete_aliases: False
|
||||
timeout_override:
|
||||
continue_if_exception: False
|
||||
disable_action: False
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: regex
|
||||
value: '^(logstash-gcp.*|so-gcp.*)$'
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{cur_close_days}}
|
||||
exclude:
|
||||
29
salt/curator/files/action/so-gcp-delete.yml
Normal file
29
salt/curator/files/action/so-gcp-delete.yml
Normal file
@@ -0,0 +1,29 @@
|
||||
{%- set DELETE_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-gcp:delete', 365) -%}
|
||||
---
|
||||
# Remember, leave a key empty if there is no value. None will be a string,
|
||||
# not a Python "NoneType"
|
||||
#
|
||||
# Also remember that all examples have 'disable_action' set to True. If you
|
||||
# want to use this action as a template, be sure to set this to False after
|
||||
# copying it.
|
||||
actions:
|
||||
1:
|
||||
action: delete_indices
|
||||
description: >-
|
||||
Delete gcp indices when older than {{ DELETE_DAYS }} days.
|
||||
options:
|
||||
ignore_empty_list: True
|
||||
disable_action: False
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: regex
|
||||
value: '^(logstash-gcp.*|so-gcp.*)$'
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{ DELETE_DAYS }}
|
||||
exclude:
|
||||
|
||||
|
||||
24
salt/curator/files/action/so-gcp-warm.yml
Normal file
24
salt/curator/files/action/so-gcp-warm.yml
Normal file
@@ -0,0 +1,24 @@
|
||||
{%- set WARM_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-gcp:warm', 7) -%}
|
||||
actions:
|
||||
1:
|
||||
action: allocation
|
||||
description: "Apply shard allocation filtering rules to the specified indices"
|
||||
options:
|
||||
key: box_type
|
||||
value: warm
|
||||
allocation_type: require
|
||||
wait_for_completion: true
|
||||
timeout_override:
|
||||
continue_if_exception: false
|
||||
disable_action: false
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: prefix
|
||||
value: so-gcp
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{ WARM_DAYS }}
|
||||
|
||||
29
salt/curator/files/action/so-google_workspace-close.yml
Normal file
29
salt/curator/files/action/so-google_workspace-close.yml
Normal file
@@ -0,0 +1,29 @@
|
||||
{%- set cur_close_days = salt['pillar.get']('elasticsearch:index_settings:so-google_workspace:close', 30) -%}
|
||||
---
|
||||
# Remember, leave a key empty if there is no value. None will be a string,
|
||||
# not a Python "NoneType"
|
||||
#
|
||||
# Also remember that all examples have 'disable_action' set to True. If you
|
||||
# want to use this action as a template, be sure to set this to False after
|
||||
# copying it.
|
||||
actions:
|
||||
1:
|
||||
action: close
|
||||
description: >-
|
||||
Close google_workspace indices older than {{cur_close_days}} days.
|
||||
options:
|
||||
delete_aliases: False
|
||||
timeout_override:
|
||||
continue_if_exception: False
|
||||
disable_action: False
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: regex
|
||||
value: '^(logstash-google_workspace.*|so-google_workspace.*)$'
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{cur_close_days}}
|
||||
exclude:
|
||||
29
salt/curator/files/action/so-google_workspace-delete.yml
Normal file
29
salt/curator/files/action/so-google_workspace-delete.yml
Normal file
@@ -0,0 +1,29 @@
|
||||
{%- set DELETE_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-google_workspace:delete', 365) -%}
|
||||
---
|
||||
# Remember, leave a key empty if there is no value. None will be a string,
|
||||
# not a Python "NoneType"
|
||||
#
|
||||
# Also remember that all examples have 'disable_action' set to True. If you
|
||||
# want to use this action as a template, be sure to set this to False after
|
||||
# copying it.
|
||||
actions:
|
||||
1:
|
||||
action: delete_indices
|
||||
description: >-
|
||||
Delete google_workspace indices when older than {{ DELETE_DAYS }} days.
|
||||
options:
|
||||
ignore_empty_list: True
|
||||
disable_action: False
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: regex
|
||||
value: '^(logstash-google_workspace.*|so-google_workspace.*)$'
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{ DELETE_DAYS }}
|
||||
exclude:
|
||||
|
||||
|
||||
24
salt/curator/files/action/so-google_workspace-warm.yml
Normal file
24
salt/curator/files/action/so-google_workspace-warm.yml
Normal file
@@ -0,0 +1,24 @@
|
||||
{%- set WARM_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-google_workspace:warm', 7) -%}
|
||||
actions:
|
||||
1:
|
||||
action: allocation
|
||||
description: "Apply shard allocation filtering rules to the specified indices"
|
||||
options:
|
||||
key: box_type
|
||||
value: warm
|
||||
allocation_type: require
|
||||
wait_for_completion: true
|
||||
timeout_override:
|
||||
continue_if_exception: false
|
||||
disable_action: false
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: prefix
|
||||
value: so-google_workspace
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{ WARM_DAYS }}
|
||||
|
||||
29
salt/curator/files/action/so-ids-delete.yml
Normal file
29
salt/curator/files/action/so-ids-delete.yml
Normal file
@@ -0,0 +1,29 @@
|
||||
{%- set DELETE_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-ids:delete', 365) -%}
|
||||
---
|
||||
# Remember, leave a key empty if there is no value. None will be a string,
|
||||
# not a Python "NoneType"
|
||||
#
|
||||
# Also remember that all examples have 'disable_action' set to True. If you
|
||||
# want to use this action as a template, be sure to set this to False after
|
||||
# copying it.
|
||||
actions:
|
||||
1:
|
||||
action: delete_indices
|
||||
description: >-
|
||||
Delete IDS indices when older than {{ DELETE_DAYS }} days.
|
||||
options:
|
||||
ignore_empty_list: True
|
||||
disable_action: False
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: regex
|
||||
value: '^(logstash-ids.*|so-ids.*)$'
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{ DELETE_DAYS }}
|
||||
exclude:
|
||||
|
||||
|
||||
24
salt/curator/files/action/so-ids-warm.yml
Normal file
24
salt/curator/files/action/so-ids-warm.yml
Normal file
@@ -0,0 +1,24 @@
|
||||
{%- set WARM_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-ids:warm', 7) -%}
|
||||
actions:
|
||||
1:
|
||||
action: allocation
|
||||
description: "Apply shard allocation filtering rules to the specified indices"
|
||||
options:
|
||||
key: box_type
|
||||
value: warm
|
||||
allocation_type: require
|
||||
wait_for_completion: true
|
||||
timeout_override:
|
||||
continue_if_exception: false
|
||||
disable_action: false
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: prefix
|
||||
value: so-ids
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{ WARM_DAYS }}
|
||||
|
||||
29
salt/curator/files/action/so-imperva-close.yml
Normal file
29
salt/curator/files/action/so-imperva-close.yml
Normal file
@@ -0,0 +1,29 @@
|
||||
{%- set cur_close_days = salt['pillar.get']('elasticsearch:index_settings:so-imperva:close', 30) -%}
|
||||
---
|
||||
# Remember, leave a key empty if there is no value. None will be a string,
|
||||
# not a Python "NoneType"
|
||||
#
|
||||
# Also remember that all examples have 'disable_action' set to True. If you
|
||||
# want to use this action as a template, be sure to set this to False after
|
||||
# copying it.
|
||||
actions:
|
||||
1:
|
||||
action: close
|
||||
description: >-
|
||||
Close imperva indices older than {{cur_close_days}} days.
|
||||
options:
|
||||
delete_aliases: False
|
||||
timeout_override:
|
||||
continue_if_exception: False
|
||||
disable_action: False
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: regex
|
||||
value: '^(logstash-imperva.*|so-imperva.*)$'
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{cur_close_days}}
|
||||
exclude:
|
||||
29
salt/curator/files/action/so-imperva-delete.yml
Normal file
29
salt/curator/files/action/so-imperva-delete.yml
Normal file
@@ -0,0 +1,29 @@
|
||||
{%- set DELETE_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-imperva:delete', 365) -%}
|
||||
---
|
||||
# Remember, leave a key empty if there is no value. None will be a string,
|
||||
# not a Python "NoneType"
|
||||
#
|
||||
# Also remember that all examples have 'disable_action' set to True. If you
|
||||
# want to use this action as a template, be sure to set this to False after
|
||||
# copying it.
|
||||
actions:
|
||||
1:
|
||||
action: delete_indices
|
||||
description: >-
|
||||
Delete imperva indices when older than {{ DELETE_DAYS }} days.
|
||||
options:
|
||||
ignore_empty_list: True
|
||||
disable_action: False
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: regex
|
||||
value: '^(logstash-imperva.*|so-imperva.*)$'
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{ DELETE_DAYS }}
|
||||
exclude:
|
||||
|
||||
|
||||
24
salt/curator/files/action/so-imperva-warm.yml
Normal file
24
salt/curator/files/action/so-imperva-warm.yml
Normal file
@@ -0,0 +1,24 @@
|
||||
{%- set WARM_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-imperva:warm', 7) -%}
|
||||
actions:
|
||||
1:
|
||||
action: allocation
|
||||
description: "Apply shard allocation filtering rules to the specified indices"
|
||||
options:
|
||||
key: box_type
|
||||
value: warm
|
||||
allocation_type: require
|
||||
wait_for_completion: true
|
||||
timeout_override:
|
||||
continue_if_exception: false
|
||||
disable_action: false
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: prefix
|
||||
value: so-imperva
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{ WARM_DAYS }}
|
||||
|
||||
29
salt/curator/files/action/so-import-delete.yml
Normal file
29
salt/curator/files/action/so-import-delete.yml
Normal file
@@ -0,0 +1,29 @@
|
||||
{%- set DELETE_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-import:delete', 365) -%}
|
||||
---
|
||||
# Remember, leave a key empty if there is no value. None will be a string,
|
||||
# not a Python "NoneType"
|
||||
#
|
||||
# Also remember that all examples have 'disable_action' set to True. If you
|
||||
# want to use this action as a template, be sure to set this to False after
|
||||
# copying it.
|
||||
actions:
|
||||
1:
|
||||
action: delete_indices
|
||||
description: >-
|
||||
Delete import indices when older than {{ DELETE_DAYS }} days.
|
||||
options:
|
||||
ignore_empty_list: True
|
||||
disable_action: False
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: regex
|
||||
value: '^(logstash-import.*|so-import.*)$'
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{ DELETE_DAYS }}
|
||||
exclude:
|
||||
|
||||
|
||||
24
salt/curator/files/action/so-import-warm.yml
Normal file
24
salt/curator/files/action/so-import-warm.yml
Normal file
@@ -0,0 +1,24 @@
|
||||
{%- set WARM_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-import:warm', 7) -%}
|
||||
actions:
|
||||
1:
|
||||
action: allocation
|
||||
description: "Apply shard allocation filtering rules to the specified indices"
|
||||
options:
|
||||
key: box_type
|
||||
value: warm
|
||||
allocation_type: require
|
||||
wait_for_completion: true
|
||||
timeout_override:
|
||||
continue_if_exception: false
|
||||
disable_action: false
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: prefix
|
||||
value: so-import
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{ WARM_DAYS }}
|
||||
|
||||
29
salt/curator/files/action/so-infoblox-close.yml
Normal file
29
salt/curator/files/action/so-infoblox-close.yml
Normal file
@@ -0,0 +1,29 @@
|
||||
{%- set cur_close_days = salt['pillar.get']('elasticsearch:index_settings:so-infoblox:close', 30) -%}
|
||||
---
|
||||
# Remember, leave a key empty if there is no value. None will be a string,
|
||||
# not a Python "NoneType"
|
||||
#
|
||||
# Also remember that all examples have 'disable_action' set to True. If you
|
||||
# want to use this action as a template, be sure to set this to False after
|
||||
# copying it.
|
||||
actions:
|
||||
1:
|
||||
action: close
|
||||
description: >-
|
||||
Close infoblox indices older than {{cur_close_days}} days.
|
||||
options:
|
||||
delete_aliases: False
|
||||
timeout_override:
|
||||
continue_if_exception: False
|
||||
disable_action: False
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: regex
|
||||
value: '^(logstash-infoblox.*|so-infoblox.*)$'
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{cur_close_days}}
|
||||
exclude:
|
||||
29
salt/curator/files/action/so-infoblox-delete.yml
Normal file
29
salt/curator/files/action/so-infoblox-delete.yml
Normal file
@@ -0,0 +1,29 @@
|
||||
{%- set DELETE_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-infoblox:delete', 365) -%}
|
||||
---
|
||||
# Remember, leave a key empty if there is no value. None will be a string,
|
||||
# not a Python "NoneType"
|
||||
#
|
||||
# Also remember that all examples have 'disable_action' set to True. If you
|
||||
# want to use this action as a template, be sure to set this to False after
|
||||
# copying it.
|
||||
actions:
|
||||
1:
|
||||
action: delete_indices
|
||||
description: >-
|
||||
Delete infoblox indices when older than {{ DELETE_DAYS }} days.
|
||||
options:
|
||||
ignore_empty_list: True
|
||||
disable_action: False
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: regex
|
||||
value: '^(logstash-infoblox.*|so-infoblox.*)$'
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{ DELETE_DAYS }}
|
||||
exclude:
|
||||
|
||||
|
||||
24
salt/curator/files/action/so-infoblox-warm.yml
Normal file
24
salt/curator/files/action/so-infoblox-warm.yml
Normal file
@@ -0,0 +1,24 @@
|
||||
{%- set WARM_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-infoblox:warm', 7) -%}
|
||||
actions:
|
||||
1:
|
||||
action: allocation
|
||||
description: "Apply shard allocation filtering rules to the specified indices"
|
||||
options:
|
||||
key: box_type
|
||||
value: warm
|
||||
allocation_type: require
|
||||
wait_for_completion: true
|
||||
timeout_override:
|
||||
continue_if_exception: false
|
||||
disable_action: false
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: prefix
|
||||
value: so-infoblox
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{ WARM_DAYS }}
|
||||
|
||||
29
salt/curator/files/action/so-juniper-close.yml
Normal file
29
salt/curator/files/action/so-juniper-close.yml
Normal file
@@ -0,0 +1,29 @@
|
||||
{%- set cur_close_days = salt['pillar.get']('elasticsearch:index_settings:so-juniper:close', 30) -%}
|
||||
---
|
||||
# Remember, leave a key empty if there is no value. None will be a string,
|
||||
# not a Python "NoneType"
|
||||
#
|
||||
# Also remember that all examples have 'disable_action' set to True. If you
|
||||
# want to use this action as a template, be sure to set this to False after
|
||||
# copying it.
|
||||
actions:
|
||||
1:
|
||||
action: close
|
||||
description: >-
|
||||
Close juniper indices older than {{cur_close_days}} days.
|
||||
options:
|
||||
delete_aliases: False
|
||||
timeout_override:
|
||||
continue_if_exception: False
|
||||
disable_action: False
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: regex
|
||||
value: '^(logstash-juniper.*|so-juniper.*)$'
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{cur_close_days}}
|
||||
exclude:
|
||||
29
salt/curator/files/action/so-juniper-delete.yml
Normal file
29
salt/curator/files/action/so-juniper-delete.yml
Normal file
@@ -0,0 +1,29 @@
|
||||
{%- set DELETE_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-juniper:delete', 365) -%}
|
||||
---
|
||||
# Remember, leave a key empty if there is no value. None will be a string,
|
||||
# not a Python "NoneType"
|
||||
#
|
||||
# Also remember that all examples have 'disable_action' set to True. If you
|
||||
# want to use this action as a template, be sure to set this to False after
|
||||
# copying it.
|
||||
actions:
|
||||
1:
|
||||
action: delete_indices
|
||||
description: >-
|
||||
Delete juniper indices when older than {{ DELETE_DAYS }} days.
|
||||
options:
|
||||
ignore_empty_list: True
|
||||
disable_action: False
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: regex
|
||||
value: '^(logstash-juniper.*|so-juniper.*)$'
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{ DELETE_DAYS }}
|
||||
exclude:
|
||||
|
||||
|
||||
24
salt/curator/files/action/so-juniper-warm.yml
Normal file
24
salt/curator/files/action/so-juniper-warm.yml
Normal file
@@ -0,0 +1,24 @@
|
||||
{%- set WARM_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-aws:warm', 7) -%}
|
||||
actions:
|
||||
1:
|
||||
action: allocation
|
||||
description: "Apply shard allocation filtering rules to the specified indices"
|
||||
options:
|
||||
key: box_type
|
||||
value: warm
|
||||
allocation_type: require
|
||||
wait_for_completion: true
|
||||
timeout_override:
|
||||
continue_if_exception: false
|
||||
disable_action: false
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: prefix
|
||||
value: so-aws
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{ WARM_DAYS }}
|
||||
|
||||
29
salt/curator/files/action/so-kibana-close.yml
Normal file
29
salt/curator/files/action/so-kibana-close.yml
Normal file
@@ -0,0 +1,29 @@
|
||||
{%- set cur_close_days = salt['pillar.get']('elasticsearch:index_settings:so-kibana:close', 30) -%}
|
||||
---
|
||||
# Remember, leave a key empty if there is no value. None will be a string,
|
||||
# not a Python "NoneType"
|
||||
#
|
||||
# Also remember that all examples have 'disable_action' set to True. If you
|
||||
# want to use this action as a template, be sure to set this to False after
|
||||
# copying it.
|
||||
actions:
|
||||
1:
|
||||
action: close
|
||||
description: >-
|
||||
Close kibana indices older than {{cur_close_days}} days.
|
||||
options:
|
||||
delete_aliases: False
|
||||
timeout_override:
|
||||
continue_if_exception: False
|
||||
disable_action: False
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: regex
|
||||
value: '^(logstash-kibana.*|so-kibana.*)$'
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{cur_close_days}}
|
||||
exclude:
|
||||
29
salt/curator/files/action/so-kibana-delete.yml
Normal file
29
salt/curator/files/action/so-kibana-delete.yml
Normal file
@@ -0,0 +1,29 @@
|
||||
{%- set DELETE_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-kibana:delete', 365) -%}
|
||||
---
|
||||
# Remember, leave a key empty if there is no value. None will be a string,
|
||||
# not a Python "NoneType"
|
||||
#
|
||||
# Also remember that all examples have 'disable_action' set to True. If you
|
||||
# want to use this action as a template, be sure to set this to False after
|
||||
# copying it.
|
||||
actions:
|
||||
1:
|
||||
action: delete_indices
|
||||
description: >-
|
||||
Delete kibana indices when older than {{ DELETE_DAYS }} days.
|
||||
options:
|
||||
ignore_empty_list: True
|
||||
disable_action: False
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: regex
|
||||
value: '^(logstash-kibana.*|so-kibana.*)$'
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{ DELETE_DAYS }}
|
||||
exclude:
|
||||
|
||||
|
||||
24
salt/curator/files/action/so-kibana-warm.yml
Normal file
24
salt/curator/files/action/so-kibana-warm.yml
Normal file
@@ -0,0 +1,24 @@
|
||||
{%- set WARM_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-kibana:warm', 7) -%}
|
||||
actions:
|
||||
1:
|
||||
action: allocation
|
||||
description: "Apply shard allocation filtering rules to the specified indices"
|
||||
options:
|
||||
key: box_type
|
||||
value: warm
|
||||
allocation_type: require
|
||||
wait_for_completion: true
|
||||
timeout_override:
|
||||
continue_if_exception: false
|
||||
disable_action: false
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: prefix
|
||||
value: so-kibana
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{ WARM_DAYS }}
|
||||
|
||||
29
salt/curator/files/action/so-logstash-close.yml
Normal file
29
salt/curator/files/action/so-logstash-close.yml
Normal file
@@ -0,0 +1,29 @@
|
||||
{%- set cur_close_days = salt['pillar.get']('elasticsearch:index_settings:so-logstash:close', 30) -%}
|
||||
---
|
||||
# Remember, leave a key empty if there is no value. None will be a string,
|
||||
# not a Python "NoneType"
|
||||
#
|
||||
# Also remember that all examples have 'disable_action' set to True. If you
|
||||
# want to use this action as a template, be sure to set this to False after
|
||||
# copying it.
|
||||
actions:
|
||||
1:
|
||||
action: close
|
||||
description: >-
|
||||
Close logstash indices older than {{cur_close_days}} days.
|
||||
options:
|
||||
delete_aliases: False
|
||||
timeout_override:
|
||||
continue_if_exception: False
|
||||
disable_action: False
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: regex
|
||||
value: '^(logstash-logstash.*|so-logstash.*)$'
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{cur_close_days}}
|
||||
exclude:
|
||||
29
salt/curator/files/action/so-logstash-delete.yml
Normal file
29
salt/curator/files/action/so-logstash-delete.yml
Normal file
@@ -0,0 +1,29 @@
|
||||
{%- set DELETE_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-logstash:delete', 365) -%}
|
||||
---
|
||||
# Remember, leave a key empty if there is no value. None will be a string,
|
||||
# not a Python "NoneType"
|
||||
#
|
||||
# Also remember that all examples have 'disable_action' set to True. If you
|
||||
# want to use this action as a template, be sure to set this to False after
|
||||
# copying it.
|
||||
actions:
|
||||
1:
|
||||
action: delete_indices
|
||||
description: >-
|
||||
Delete logstash indices when older than {{ DELETE_DAYS }} days.
|
||||
options:
|
||||
ignore_empty_list: True
|
||||
disable_action: False
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: regex
|
||||
value: '^(logstash-logstash.*|so-logstash.*)$'
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{ DELETE_DAYS }}
|
||||
exclude:
|
||||
|
||||
|
||||
24
salt/curator/files/action/so-logstash-warm.yml
Normal file
24
salt/curator/files/action/so-logstash-warm.yml
Normal file
@@ -0,0 +1,24 @@
|
||||
{%- set WARM_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-logstash:warm', 7) -%}
|
||||
actions:
|
||||
1:
|
||||
action: allocation
|
||||
description: "Apply shard allocation filtering rules to the specified indices"
|
||||
options:
|
||||
key: box_type
|
||||
value: warm
|
||||
allocation_type: require
|
||||
wait_for_completion: true
|
||||
timeout_override:
|
||||
continue_if_exception: false
|
||||
disable_action: false
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: prefix
|
||||
value: so-logstash
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{ WARM_DAYS }}
|
||||
|
||||
29
salt/curator/files/action/so-microsoft-close.yml
Normal file
29
salt/curator/files/action/so-microsoft-close.yml
Normal file
@@ -0,0 +1,29 @@
|
||||
{%- set cur_close_days = salt['pillar.get']('elasticsearch:index_settings:so-microsoft:close', 30) -%}
|
||||
---
|
||||
# Remember, leave a key empty if there is no value. None will be a string,
|
||||
# not a Python "NoneType"
|
||||
#
|
||||
# Also remember that all examples have 'disable_action' set to True. If you
|
||||
# want to use this action as a template, be sure to set this to False after
|
||||
# copying it.
|
||||
actions:
|
||||
1:
|
||||
action: close
|
||||
description: >-
|
||||
Close microsoft indices older than {{cur_close_days}} days.
|
||||
options:
|
||||
delete_aliases: False
|
||||
timeout_override:
|
||||
continue_if_exception: False
|
||||
disable_action: False
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: regex
|
||||
value: '^(logstash-microsoft.*|so-microsoft.*)$'
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{cur_close_days}}
|
||||
exclude:
|
||||
29
salt/curator/files/action/so-microsoft-delete.yml
Normal file
29
salt/curator/files/action/so-microsoft-delete.yml
Normal file
@@ -0,0 +1,29 @@
|
||||
{%- set DELETE_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-microsoft:delete', 365) -%}
|
||||
---
|
||||
# Remember, leave a key empty if there is no value. None will be a string,
|
||||
# not a Python "NoneType"
|
||||
#
|
||||
# Also remember that all examples have 'disable_action' set to True. If you
|
||||
# want to use this action as a template, be sure to set this to False after
|
||||
# copying it.
|
||||
actions:
|
||||
1:
|
||||
action: delete_indices
|
||||
description: >-
|
||||
Delete microsoft indices when older than {{ DELETE_DAYS }} days.
|
||||
options:
|
||||
ignore_empty_list: True
|
||||
disable_action: False
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: regex
|
||||
value: '^(logstash-microsoft.*|so-microsoft.*)$'
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{ DELETE_DAYS }}
|
||||
exclude:
|
||||
|
||||
|
||||
24
salt/curator/files/action/so-microsoft-warm.yml
Normal file
24
salt/curator/files/action/so-microsoft-warm.yml
Normal file
@@ -0,0 +1,24 @@
|
||||
{%- set WARM_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-microsoft:warm', 7) -%}
|
||||
actions:
|
||||
1:
|
||||
action: allocation
|
||||
description: "Apply shard allocation filtering rules to the specified indices"
|
||||
options:
|
||||
key: box_type
|
||||
value: warm
|
||||
allocation_type: require
|
||||
wait_for_completion: true
|
||||
timeout_override:
|
||||
continue_if_exception: false
|
||||
disable_action: false
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: prefix
|
||||
value: so-microsoft
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{ WARM_DAYS }}
|
||||
|
||||
29
salt/curator/files/action/so-misp-close.yml
Normal file
29
salt/curator/files/action/so-misp-close.yml
Normal file
@@ -0,0 +1,29 @@
|
||||
{%- set cur_close_days = salt['pillar.get']('elasticsearch:index_settings:so-misp:close', 30) -%}
|
||||
---
|
||||
# Remember, leave a key empty if there is no value. None will be a string,
|
||||
# not a Python "NoneType"
|
||||
#
|
||||
# Also remember that all examples have 'disable_action' set to True. If you
|
||||
# want to use this action as a template, be sure to set this to False after
|
||||
# copying it.
|
||||
actions:
|
||||
1:
|
||||
action: close
|
||||
description: >-
|
||||
Close misp indices older than {{cur_close_days}} days.
|
||||
options:
|
||||
delete_aliases: False
|
||||
timeout_override:
|
||||
continue_if_exception: False
|
||||
disable_action: False
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: regex
|
||||
value: '^(logstash-misp.*|so-misp.*)$'
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{cur_close_days}}
|
||||
exclude:
|
||||
29
salt/curator/files/action/so-misp-delete.yml
Normal file
29
salt/curator/files/action/so-misp-delete.yml
Normal file
@@ -0,0 +1,29 @@
|
||||
{%- set DELETE_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-misp:delete', 365) -%}
|
||||
---
|
||||
# Remember, leave a key empty if there is no value. None will be a string,
|
||||
# not a Python "NoneType"
|
||||
#
|
||||
# Also remember that all examples have 'disable_action' set to True. If you
|
||||
# want to use this action as a template, be sure to set this to False after
|
||||
# copying it.
|
||||
actions:
|
||||
1:
|
||||
action: delete_indices
|
||||
description: >-
|
||||
Delete misp indices when older than {{ DELETE_DAYS }} days.
|
||||
options:
|
||||
ignore_empty_list: True
|
||||
disable_action: False
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: regex
|
||||
value: '^(logstash-misp.*|so-misp.*)$'
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{ DELETE_DAYS }}
|
||||
exclude:
|
||||
|
||||
|
||||
24
salt/curator/files/action/so-misp-warm.yml
Normal file
24
salt/curator/files/action/so-misp-warm.yml
Normal file
@@ -0,0 +1,24 @@
|
||||
{%- set WARM_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-misp:warm', 7) -%}
|
||||
actions:
|
||||
1:
|
||||
action: allocation
|
||||
description: "Apply shard allocation filtering rules to the specified indices"
|
||||
options:
|
||||
key: box_type
|
||||
value: warm
|
||||
allocation_type: require
|
||||
wait_for_completion: true
|
||||
timeout_override:
|
||||
continue_if_exception: false
|
||||
disable_action: false
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: prefix
|
||||
value: so-misp
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{ WARM_DAYS }}
|
||||
|
||||
29
salt/curator/files/action/so-netflow-close.yml
Normal file
29
salt/curator/files/action/so-netflow-close.yml
Normal file
@@ -0,0 +1,29 @@
|
||||
{%- set cur_close_days = salt['pillar.get']('elasticsearch:index_settings:so-netflow:close', 30) -%}
|
||||
---
|
||||
# Remember, leave a key empty if there is no value. None will be a string,
|
||||
# not a Python "NoneType"
|
||||
#
|
||||
# Also remember that all examples have 'disable_action' set to True. If you
|
||||
# want to use this action as a template, be sure to set this to False after
|
||||
# copying it.
|
||||
actions:
|
||||
1:
|
||||
action: close
|
||||
description: >-
|
||||
Close netflow indices older than {{cur_close_days}} days.
|
||||
options:
|
||||
delete_aliases: False
|
||||
timeout_override:
|
||||
continue_if_exception: False
|
||||
disable_action: False
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: regex
|
||||
value: '^(logstash-netflow.*|so-netflow.*)$'
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{cur_close_days}}
|
||||
exclude:
|
||||
29
salt/curator/files/action/so-netflow-delete.yml
Normal file
29
salt/curator/files/action/so-netflow-delete.yml
Normal file
@@ -0,0 +1,29 @@
|
||||
{%- set DELETE_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-netflow:delete', 365) -%}
|
||||
---
|
||||
# Remember, leave a key empty if there is no value. None will be a string,
|
||||
# not a Python "NoneType"
|
||||
#
|
||||
# Also remember that all examples have 'disable_action' set to True. If you
|
||||
# want to use this action as a template, be sure to set this to False after
|
||||
# copying it.
|
||||
actions:
|
||||
1:
|
||||
action: delete_indices
|
||||
description: >-
|
||||
Delete netflow indices when older than {{ DELETE_DAYS }} days.
|
||||
options:
|
||||
ignore_empty_list: True
|
||||
disable_action: False
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: regex
|
||||
value: '^(logstash-netflow.*|so-netflow.*)$'
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{ DELETE_DAYS }}
|
||||
exclude:
|
||||
|
||||
|
||||
24
salt/curator/files/action/so-netflow-warm.yml
Normal file
24
salt/curator/files/action/so-netflow-warm.yml
Normal file
@@ -0,0 +1,24 @@
|
||||
{%- set WARM_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-netflow:warm', 7) -%}
|
||||
actions:
|
||||
1:
|
||||
action: allocation
|
||||
description: "Apply shard allocation filtering rules to the specified indices"
|
||||
options:
|
||||
key: box_type
|
||||
value: warm
|
||||
allocation_type: require
|
||||
wait_for_completion: true
|
||||
timeout_override:
|
||||
continue_if_exception: false
|
||||
disable_action: false
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: prefix
|
||||
value: so-netflow
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{ WARM_DAYS }}
|
||||
|
||||
29
salt/curator/files/action/so-netscout-close.yml
Normal file
29
salt/curator/files/action/so-netscout-close.yml
Normal file
@@ -0,0 +1,29 @@
|
||||
{%- set cur_close_days = salt['pillar.get']('elasticsearch:index_settings:so-netscout:close', 30) -%}
|
||||
---
|
||||
# Remember, leave a key empty if there is no value. None will be a string,
|
||||
# not a Python "NoneType"
|
||||
#
|
||||
# Also remember that all examples have 'disable_action' set to True. If you
|
||||
# want to use this action as a template, be sure to set this to False after
|
||||
# copying it.
|
||||
actions:
|
||||
1:
|
||||
action: close
|
||||
description: >-
|
||||
Close netscout indices older than {{cur_close_days}} days.
|
||||
options:
|
||||
delete_aliases: False
|
||||
timeout_override:
|
||||
continue_if_exception: False
|
||||
disable_action: False
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: regex
|
||||
value: '^(logstash-netscout.*|so-netscout.*)$'
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{cur_close_days}}
|
||||
exclude:
|
||||
29
salt/curator/files/action/so-netscout-delete.yml
Normal file
29
salt/curator/files/action/so-netscout-delete.yml
Normal file
@@ -0,0 +1,29 @@
|
||||
{%- set DELETE_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-netscout:delete', 365) -%}
|
||||
---
|
||||
# Remember, leave a key empty if there is no value. None will be a string,
|
||||
# not a Python "NoneType"
|
||||
#
|
||||
# Also remember that all examples have 'disable_action' set to True. If you
|
||||
# want to use this action as a template, be sure to set this to False after
|
||||
# copying it.
|
||||
actions:
|
||||
1:
|
||||
action: delete_indices
|
||||
description: >-
|
||||
Delete netscout indices when older than {{ DELETE_DAYS }} days.
|
||||
options:
|
||||
ignore_empty_list: True
|
||||
disable_action: False
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: regex
|
||||
value: '^(logstash-netscout.*|so-netscout.*)$'
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{ DELETE_DAYS }}
|
||||
exclude:
|
||||
|
||||
|
||||
24
salt/curator/files/action/so-netscout-warm.yml
Normal file
24
salt/curator/files/action/so-netscout-warm.yml
Normal file
@@ -0,0 +1,24 @@
|
||||
{%- set WARM_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-netscout:warm', 7) -%}
|
||||
actions:
|
||||
1:
|
||||
action: allocation
|
||||
description: "Apply shard allocation filtering rules to the specified indices"
|
||||
options:
|
||||
key: box_type
|
||||
value: warm
|
||||
allocation_type: require
|
||||
wait_for_completion: true
|
||||
timeout_override:
|
||||
continue_if_exception: false
|
||||
disable_action: false
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: prefix
|
||||
value: so-netscout
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{ WARM_DAYS }}
|
||||
|
||||
29
salt/curator/files/action/so-o365-close.yml
Normal file
29
salt/curator/files/action/so-o365-close.yml
Normal file
@@ -0,0 +1,29 @@
|
||||
{%- set cur_close_days = salt['pillar.get']('elasticsearch:index_settings:so-o365:close', 30) -%}
|
||||
---
|
||||
# Remember, leave a key empty if there is no value. None will be a string,
|
||||
# not a Python "NoneType"
|
||||
#
|
||||
# Also remember that all examples have 'disable_action' set to True. If you
|
||||
# want to use this action as a template, be sure to set this to False after
|
||||
# copying it.
|
||||
actions:
|
||||
1:
|
||||
action: close
|
||||
description: >-
|
||||
Close o365 indices older than {{cur_close_days}} days.
|
||||
options:
|
||||
delete_aliases: False
|
||||
timeout_override:
|
||||
continue_if_exception: False
|
||||
disable_action: False
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: regex
|
||||
value: '^(logstash-o365.*|so-o365.*)$'
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{cur_close_days}}
|
||||
exclude:
|
||||
29
salt/curator/files/action/so-o365-delete.yml
Normal file
29
salt/curator/files/action/so-o365-delete.yml
Normal file
@@ -0,0 +1,29 @@
|
||||
{%- set DELETE_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-o365:delete', 365) -%}
|
||||
---
|
||||
# Remember, leave a key empty if there is no value. None will be a string,
|
||||
# not a Python "NoneType"
|
||||
#
|
||||
# Also remember that all examples have 'disable_action' set to True. If you
|
||||
# want to use this action as a template, be sure to set this to False after
|
||||
# copying it.
|
||||
actions:
|
||||
1:
|
||||
action: delete_indices
|
||||
description: >-
|
||||
Delete o365 indices when older than {{ DELETE_DAYS }} days.
|
||||
options:
|
||||
ignore_empty_list: True
|
||||
disable_action: False
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: regex
|
||||
value: '^(logstash-o365.*|so-o365.*)$'
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{ DELETE_DAYS }}
|
||||
exclude:
|
||||
|
||||
|
||||
24
salt/curator/files/action/so-o365-warm.yml
Normal file
24
salt/curator/files/action/so-o365-warm.yml
Normal file
@@ -0,0 +1,24 @@
|
||||
{%- set WARM_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-o365:warm', 7) -%}
|
||||
actions:
|
||||
1:
|
||||
action: allocation
|
||||
description: "Apply shard allocation filtering rules to the specified indices"
|
||||
options:
|
||||
key: box_type
|
||||
value: warm
|
||||
allocation_type: require
|
||||
wait_for_completion: true
|
||||
timeout_override:
|
||||
continue_if_exception: false
|
||||
disable_action: false
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: prefix
|
||||
value: so-o365
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{ WARM_DAYS }}
|
||||
|
||||
29
salt/curator/files/action/so-okta-close.yml
Normal file
29
salt/curator/files/action/so-okta-close.yml
Normal file
@@ -0,0 +1,29 @@
|
||||
{%- set cur_close_days = salt['pillar.get']('elasticsearch:index_settings:so-okta:close', 30) -%}
|
||||
---
|
||||
# Remember, leave a key empty if there is no value. None will be a string,
|
||||
# not a Python "NoneType"
|
||||
#
|
||||
# Also remember that all examples have 'disable_action' set to True. If you
|
||||
# want to use this action as a template, be sure to set this to False after
|
||||
# copying it.
|
||||
actions:
|
||||
1:
|
||||
action: close
|
||||
description: >-
|
||||
Close okta indices older than {{cur_close_days}} days.
|
||||
options:
|
||||
delete_aliases: False
|
||||
timeout_override:
|
||||
continue_if_exception: False
|
||||
disable_action: False
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: regex
|
||||
value: '^(logstash-okta.*|so-okta.*)$'
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{cur_close_days}}
|
||||
exclude:
|
||||
24
salt/curator/files/action/so-okta-warm.yml
Normal file
24
salt/curator/files/action/so-okta-warm.yml
Normal file
@@ -0,0 +1,24 @@
|
||||
{%- set WARM_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-okta:warm', 7) -%}
|
||||
actions:
|
||||
1:
|
||||
action: allocation
|
||||
description: "Apply shard allocation filtering rules to the specified indices"
|
||||
options:
|
||||
key: box_type
|
||||
value: warm
|
||||
allocation_type: require
|
||||
wait_for_completion: true
|
||||
timeout_override:
|
||||
continue_if_exception: false
|
||||
disable_action: false
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: prefix
|
||||
value: so-okta
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{ WARM_DAYS }}
|
||||
|
||||
29
salt/curator/files/action/so-okta.delete.yml
Normal file
29
salt/curator/files/action/so-okta.delete.yml
Normal file
@@ -0,0 +1,29 @@
|
||||
{%- set DELETE_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-okta:delete', 365) -%}
|
||||
---
|
||||
# Remember, leave a key empty if there is no value. None will be a string,
|
||||
# not a Python "NoneType"
|
||||
#
|
||||
# Also remember that all examples have 'disable_action' set to True. If you
|
||||
# want to use this action as a template, be sure to set this to False after
|
||||
# copying it.
|
||||
actions:
|
||||
1:
|
||||
action: delete_indices
|
||||
description: >-
|
||||
Delete okta indices when older than {{ DELETE_DAYS }} days.
|
||||
options:
|
||||
ignore_empty_list: True
|
||||
disable_action: False
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: regex
|
||||
value: '^(logstash-okta.*|so-okta.*)$'
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{ DELETE_DAYS }}
|
||||
exclude:
|
||||
|
||||
|
||||
29
salt/curator/files/action/so-osquery-delete.yml
Normal file
29
salt/curator/files/action/so-osquery-delete.yml
Normal file
@@ -0,0 +1,29 @@
|
||||
{%- set DELETE_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-osquery:delete', 365) -%}
|
||||
---
|
||||
# Remember, leave a key empty if there is no value. None will be a string,
|
||||
# not a Python "NoneType"
|
||||
#
|
||||
# Also remember that all examples have 'disable_action' set to True. If you
|
||||
# want to use this action as a template, be sure to set this to False after
|
||||
# copying it.
|
||||
actions:
|
||||
1:
|
||||
action: delete_indices
|
||||
description: >-
|
||||
Delete import indices when older than {{ DELETE_DAYS }} days.
|
||||
options:
|
||||
ignore_empty_list: True
|
||||
disable_action: False
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: regex
|
||||
value: '^(logstash-osquery.*|so-osquery.*)$'
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{ DELETE_DAYS }}
|
||||
exclude:
|
||||
|
||||
|
||||
24
salt/curator/files/action/so-osquery-warm.yml
Normal file
24
salt/curator/files/action/so-osquery-warm.yml
Normal file
@@ -0,0 +1,24 @@
|
||||
{%- set WARM_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-osquery:warm', 7) -%}
|
||||
actions:
|
||||
1:
|
||||
action: allocation
|
||||
description: "Apply shard allocation filtering rules to the specified indices"
|
||||
options:
|
||||
key: box_type
|
||||
value: warm
|
||||
allocation_type: require
|
||||
wait_for_completion: true
|
||||
timeout_override:
|
||||
continue_if_exception: false
|
||||
disable_action: false
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: prefix
|
||||
value: so-osquery
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{ WARM_DAYS }}
|
||||
|
||||
29
salt/curator/files/action/so-ossec-delete.yml
Normal file
29
salt/curator/files/action/so-ossec-delete.yml
Normal file
@@ -0,0 +1,29 @@
|
||||
{%- set DELETE_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-ossec:delete', 365) -%}
|
||||
---
|
||||
# Remember, leave a key empty if there is no value. None will be a string,
|
||||
# not a Python "NoneType"
|
||||
#
|
||||
# Also remember that all examples have 'disable_action' set to True. If you
|
||||
# want to use this action as a template, be sure to set this to False after
|
||||
# copying it.
|
||||
actions:
|
||||
1:
|
||||
action: delete_indices
|
||||
description: >-
|
||||
Delete ossec indices when older than {{ DELETE_DAYS }} days.
|
||||
options:
|
||||
ignore_empty_list: True
|
||||
disable_action: False
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: regex
|
||||
value: '^(logstash-ossec.*|so-ossec.*)$'
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{ DELETE_DAYS }}
|
||||
exclude:
|
||||
|
||||
|
||||
24
salt/curator/files/action/so-ossec-warm.yml
Normal file
24
salt/curator/files/action/so-ossec-warm.yml
Normal file
@@ -0,0 +1,24 @@
|
||||
{%- set WARM_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-ossec:warm', 7) -%}
|
||||
actions:
|
||||
1:
|
||||
action: allocation
|
||||
description: "Apply shard allocation filtering rules to the specified indices"
|
||||
options:
|
||||
key: box_type
|
||||
value: warm
|
||||
allocation_type: require
|
||||
wait_for_completion: true
|
||||
timeout_override:
|
||||
continue_if_exception: false
|
||||
disable_action: false
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: prefix
|
||||
value: so-ossec
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{ WARM_DAYS }}
|
||||
|
||||
29
salt/curator/files/action/so-proofpoint-close.yml
Normal file
29
salt/curator/files/action/so-proofpoint-close.yml
Normal file
@@ -0,0 +1,29 @@
|
||||
{%- set cur_close_days = salt['pillar.get']('elasticsearch:index_settings:so-proofpoint:close', 30) -%}
|
||||
---
|
||||
# Remember, leave a key empty if there is no value. None will be a string,
|
||||
# not a Python "NoneType"
|
||||
#
|
||||
# Also remember that all examples have 'disable_action' set to True. If you
|
||||
# want to use this action as a template, be sure to set this to False after
|
||||
# copying it.
|
||||
actions:
|
||||
1:
|
||||
action: close
|
||||
description: >-
|
||||
Close proofpoint indices older than {{cur_close_days}} days.
|
||||
options:
|
||||
delete_aliases: False
|
||||
timeout_override:
|
||||
continue_if_exception: False
|
||||
disable_action: False
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: regex
|
||||
value: '^(logstash-proofpoint.*|so-proofpoint.*)$'
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{cur_close_days}}
|
||||
exclude:
|
||||
29
salt/curator/files/action/so-proofpoint-delete.yml
Normal file
29
salt/curator/files/action/so-proofpoint-delete.yml
Normal file
@@ -0,0 +1,29 @@
|
||||
{%- set DELETE_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-proofpoint:delete', 365) -%}
|
||||
---
|
||||
# Remember, leave a key empty if there is no value. None will be a string,
|
||||
# not a Python "NoneType"
|
||||
#
|
||||
# Also remember that all examples have 'disable_action' set to True. If you
|
||||
# want to use this action as a template, be sure to set this to False after
|
||||
# copying it.
|
||||
actions:
|
||||
1:
|
||||
action: delete_indices
|
||||
description: >-
|
||||
Delete proofpoint indices when older than {{ DELETE_DAYS }} days.
|
||||
options:
|
||||
ignore_empty_list: True
|
||||
disable_action: False
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: regex
|
||||
value: '^(logstash-proofpoint.*|so-proofpoint.*)$'
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{ DELETE_DAYS }}
|
||||
exclude:
|
||||
|
||||
|
||||
24
salt/curator/files/action/so-proofpoint-warm.yml
Normal file
24
salt/curator/files/action/so-proofpoint-warm.yml
Normal file
@@ -0,0 +1,24 @@
|
||||
{%- set WARM_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-proofpoint:warm', 7) -%}
|
||||
actions:
|
||||
1:
|
||||
action: allocation
|
||||
description: "Apply shard allocation filtering rules to the specified indices"
|
||||
options:
|
||||
key: box_type
|
||||
value: warm
|
||||
allocation_type: require
|
||||
wait_for_completion: true
|
||||
timeout_override:
|
||||
continue_if_exception: false
|
||||
disable_action: false
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: prefix
|
||||
value: so-proofpoint
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{ WARM_DAYS }}
|
||||
|
||||
29
salt/curator/files/action/so-radware-close.yml
Normal file
29
salt/curator/files/action/so-radware-close.yml
Normal file
@@ -0,0 +1,29 @@
|
||||
{%- set cur_close_days = salt['pillar.get']('elasticsearch:index_settings:so-radware:close', 30) -%}
|
||||
---
|
||||
# Remember, leave a key empty if there is no value. None will be a string,
|
||||
# not a Python "NoneType"
|
||||
#
|
||||
# Also remember that all examples have 'disable_action' set to True. If you
|
||||
# want to use this action as a template, be sure to set this to False after
|
||||
# copying it.
|
||||
actions:
|
||||
1:
|
||||
action: close
|
||||
description: >-
|
||||
Close radware indices older than {{cur_close_days}} days.
|
||||
options:
|
||||
delete_aliases: False
|
||||
timeout_override:
|
||||
continue_if_exception: False
|
||||
disable_action: False
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: regex
|
||||
value: '^(logstash-radware.*|so-radware.*)$'
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{cur_close_days}}
|
||||
exclude:
|
||||
29
salt/curator/files/action/so-radware-delete.yml
Normal file
29
salt/curator/files/action/so-radware-delete.yml
Normal file
@@ -0,0 +1,29 @@
|
||||
{%- set DELETE_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-radware:delete', 365) -%}
|
||||
---
|
||||
# Remember, leave a key empty if there is no value. None will be a string,
|
||||
# not a Python "NoneType"
|
||||
#
|
||||
# Also remember that all examples have 'disable_action' set to True. If you
|
||||
# want to use this action as a template, be sure to set this to False after
|
||||
# copying it.
|
||||
actions:
|
||||
1:
|
||||
action: delete_indices
|
||||
description: >-
|
||||
Delete radware indices when older than {{ DELETE_DAYS }} days.
|
||||
options:
|
||||
ignore_empty_list: True
|
||||
disable_action: False
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: regex
|
||||
value: '^(logstash-radware.*|so-radware.*)$'
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{ DELETE_DAYS }}
|
||||
exclude:
|
||||
|
||||
|
||||
24
salt/curator/files/action/so-radware-warm.yml
Normal file
24
salt/curator/files/action/so-radware-warm.yml
Normal file
@@ -0,0 +1,24 @@
|
||||
{%- set WARM_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-radware:warm', 7) -%}
|
||||
actions:
|
||||
1:
|
||||
action: allocation
|
||||
description: "Apply shard allocation filtering rules to the specified indices"
|
||||
options:
|
||||
key: box_type
|
||||
value: warm
|
||||
allocation_type: require
|
||||
wait_for_completion: true
|
||||
timeout_override:
|
||||
continue_if_exception: false
|
||||
disable_action: false
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: prefix
|
||||
value: so-radware
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{ WARM_DAYS }}
|
||||
|
||||
29
salt/curator/files/action/so-redis-close.yml
Normal file
29
salt/curator/files/action/so-redis-close.yml
Normal file
@@ -0,0 +1,29 @@
|
||||
{%- set cur_close_days = salt['pillar.get']('elasticsearch:index_settings:so-redis:close', 30) -%}
|
||||
---
|
||||
# Remember, leave a key empty if there is no value. None will be a string,
|
||||
# not a Python "NoneType"
|
||||
#
|
||||
# Also remember that all examples have 'disable_action' set to True. If you
|
||||
# want to use this action as a template, be sure to set this to False after
|
||||
# copying it.
|
||||
actions:
|
||||
1:
|
||||
action: close
|
||||
description: >-
|
||||
Close redis indices older than {{cur_close_days}} days.
|
||||
options:
|
||||
delete_aliases: False
|
||||
timeout_override:
|
||||
continue_if_exception: False
|
||||
disable_action: False
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: regex
|
||||
value: '^(logstash-redis.*|so-redis.*)$'
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{cur_close_days}}
|
||||
exclude:
|
||||
29
salt/curator/files/action/so-redis-delete.yml
Normal file
29
salt/curator/files/action/so-redis-delete.yml
Normal file
@@ -0,0 +1,29 @@
|
||||
{%- set DELETE_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-redis:delete', 365) -%}
|
||||
---
|
||||
# Remember, leave a key empty if there is no value. None will be a string,
|
||||
# not a Python "NoneType"
|
||||
#
|
||||
# Also remember that all examples have 'disable_action' set to True. If you
|
||||
# want to use this action as a template, be sure to set this to False after
|
||||
# copying it.
|
||||
actions:
|
||||
1:
|
||||
action: delete_indices
|
||||
description: >-
|
||||
Delete redis indices when older than {{ DELETE_DAYS }} days.
|
||||
options:
|
||||
ignore_empty_list: True
|
||||
disable_action: False
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: regex
|
||||
value: '^(logstash-redis.*|so-redis.*)$'
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{ DELETE_DAYS }}
|
||||
exclude:
|
||||
|
||||
|
||||
24
salt/curator/files/action/so-redis-warm.yml
Normal file
24
salt/curator/files/action/so-redis-warm.yml
Normal file
@@ -0,0 +1,24 @@
|
||||
{%- set WARM_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-redis:warm', 7) -%}
|
||||
actions:
|
||||
1:
|
||||
action: allocation
|
||||
description: "Apply shard allocation filtering rules to the specified indices"
|
||||
options:
|
||||
key: box_type
|
||||
value: warm
|
||||
allocation_type: require
|
||||
wait_for_completion: true
|
||||
timeout_override:
|
||||
continue_if_exception: false
|
||||
disable_action: false
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: prefix
|
||||
value: so-redis
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{ WARM_DAYS }}
|
||||
|
||||
29
salt/curator/files/action/so-snort-close.yml
Normal file
29
salt/curator/files/action/so-snort-close.yml
Normal file
@@ -0,0 +1,29 @@
|
||||
{%- set cur_close_days = salt['pillar.get']('elasticsearch:index_settings:so-snort:close', 30) -%}
|
||||
---
|
||||
# Remember, leave a key empty if there is no value. None will be a string,
|
||||
# not a Python "NoneType"
|
||||
#
|
||||
# Also remember that all examples have 'disable_action' set to True. If you
|
||||
# want to use this action as a template, be sure to set this to False after
|
||||
# copying it.
|
||||
actions:
|
||||
1:
|
||||
action: close
|
||||
description: >-
|
||||
Close snort indices older than {{cur_close_days}} days.
|
||||
options:
|
||||
delete_aliases: False
|
||||
timeout_override:
|
||||
continue_if_exception: False
|
||||
disable_action: False
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: regex
|
||||
value: '^(logstash-snort.*|so-snort.*)$'
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{cur_close_days}}
|
||||
exclude:
|
||||
29
salt/curator/files/action/so-snort-delete.yml
Normal file
29
salt/curator/files/action/so-snort-delete.yml
Normal file
@@ -0,0 +1,29 @@
|
||||
{%- set DELETE_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-snort:delete', 365) -%}
|
||||
---
|
||||
# Remember, leave a key empty if there is no value. None will be a string,
|
||||
# not a Python "NoneType"
|
||||
#
|
||||
# Also remember that all examples have 'disable_action' set to True. If you
|
||||
# want to use this action as a template, be sure to set this to False after
|
||||
# copying it.
|
||||
actions:
|
||||
1:
|
||||
action: delete_indices
|
||||
description: >-
|
||||
Delete snort indices when older than {{ DELETE_DAYS }} days.
|
||||
options:
|
||||
ignore_empty_list: True
|
||||
disable_action: False
|
||||
filters:
|
||||
- filtertype: pattern
|
||||
kind: regex
|
||||
value: '^(logstash-snort.*|so-snort.*)$'
|
||||
- filtertype: age
|
||||
source: name
|
||||
direction: older
|
||||
timestring: '%Y.%m.%d'
|
||||
unit: days
|
||||
unit_count: {{ DELETE_DAYS }}
|
||||
exclude:
|
||||
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user