From 8b835284ef3ed1fffc8fd6fbf15c5ca3654be6fa Mon Sep 17 00:00:00 2001
From: m0duspwnens <josh.patterson@securityonionsolutions.com>
Date: Tue, 11 Feb 2020 14:55:44 -0500
Subject: [PATCH] adding helix eps count for telegraf

---
 salt/common/telegraf/etc/telegraf.conf   |  1 +
 salt/common/telegraf/scripts/helixeps.sh | 25 ++++++++++++++++++++++++
 2 files changed, 26 insertions(+)
 create mode 100644 salt/common/telegraf/scripts/helixeps.sh

diff --git a/salt/common/telegraf/etc/telegraf.conf b/salt/common/telegraf/etc/telegraf.conf
index 5fda428d4..3afe0e13a 100644
--- a/salt/common/telegraf/etc/telegraf.conf
+++ b/salt/common/telegraf/etc/telegraf.conf
@@ -655,6 +655,7 @@
     "/scripts/checkfiles.sh",
     "/scripts/broloss.sh",
     "/scripts/oldpcap.sh",
+    "/scripts/helixeps.sh",
   ]
   data_format = "influx"
 {% endif %}
diff --git a/salt/common/telegraf/scripts/helixeps.sh b/salt/common/telegraf/scripts/helixeps.sh
new file mode 100644
index 000000000..8ddd4a0e1
--- /dev/null
+++ b/salt/common/telegraf/scripts/helixeps.sh
@@ -0,0 +1,25 @@
+#!/bin/bash
+
+PREVCOUNTFILE='/tmp/helixevents.txt'
+EVENTCOUNTCURRENT="$(curl -s localhost:9600/_node/stats | jq '.pipelines.eval.events.out')"
+
+if [ ! -z "$EVENTCOUNTCURRENT" ]; then
+
+  if [ -f "$PREVCOUNTFILE" ]; then
+    EVENTCOUNTPREVIOUS=`cat $PREVCOUNTFILE`
+  else
+    echo "${EVENTCOUNTCURRENT}" > $PREVCOUNTFILE
+    exit 0
+  fi
+
+  echo "${EVENTCOUNTCURRENT}" > $PREVCOUNTFILE
+  EVENTS=$((EVENTCOUNTCURRENT - EVENTCOUNTPREVIOUS))
+  if [ "$EVENTS" -lt 0 ]; then
+    EVENTS=0
+  fi
+
+  echo "helixeps eps=${EVENTS}"
+
+fi
+
+exit 0