From 9c9cea62b60e7d5ee8876f2a43887b640d457f5c Mon Sep 17 00:00:00 2001
From: Mike Reeves <mike.reeves@securityonionsolutions.com>
Date: Tue, 13 Feb 2018 14:57:59 -0500
Subject: [PATCH] ES salt module - Add curator skeleton

---
 .../files/curator/action/close.yml            | 30 +++++++++++++++++++
 .../files/curator/action/delete.yml           | 23 ++++++++++++++
 salt/elasticsearch/files/curator/curator.yml  |  0
 3 files changed, 53 insertions(+)
 create mode 100644 salt/elasticsearch/files/curator/action/close.yml
 create mode 100644 salt/elasticsearch/files/curator/action/delete.yml
 create mode 100644 salt/elasticsearch/files/curator/curator.yml

diff --git a/salt/elasticsearch/files/curator/action/close.yml b/salt/elasticsearch/files/curator/action/close.yml
new file mode 100644
index 000000000..a9ca54335
--- /dev/null
+++ b/salt/elasticsearch/files/curator/action/close.yml
@@ -0,0 +1,30 @@
+---
+# Remember, leave a key empty if there is no value.  None will be a string,
+# not a Python "NoneType"
+#
+# Also remember that all examples have 'disable_action' set to True.  If you
+# want to use this action as a template, be sure to set this to False after
+# copying it.
+actions:
+  1:
+    action: close
+    description: >-
+      Close indices older than 2 days (based on index name), for logstash-
+      prefixed indices.
+    options:
+      delete_aliases: False
+      timeout_override:
+      continue_if_exception: False
+      disable_action: False
+    filters:
+    - filtertype: pattern
+      kind: prefix
+      value: logstash-
+      exclude:
+    - filtertype: age
+      source: name
+      direction: older
+      timestring: '%Y.%m.%d'
+      unit: days
+      unit_count: 2
+      exclude:
diff --git a/salt/elasticsearch/files/curator/action/delete.yml b/salt/elasticsearch/files/curator/action/delete.yml
new file mode 100644
index 000000000..cb55ec0c3
--- /dev/null
+++ b/salt/elasticsearch/files/curator/action/delete.yml
@@ -0,0 +1,23 @@
+---
+# Remember, leave a key empty if there is no value.  None will be a string,
+# not a Python "NoneType"
+#
+# Also remember that all examples have 'disable_action' set to True.  If you
+# want to use this action as a template, be sure to set this to False after
+# copying it.
+actions:
+  1:
+    action: delete_indices
+    description: >-
+      Delete indices when $disk_space value (in GB) is exceeded.
+    options:
+      ignore_empty_list: True
+      disable_action: False
+    filters:
+    - filtertype: pattern
+      kind: prefix
+      value: logstash-
+    - filtertype: space
+      source: creation_date
+      use_age: True
+      disk_space: 43
diff --git a/salt/elasticsearch/files/curator/curator.yml b/salt/elasticsearch/files/curator/curator.yml
new file mode 100644
index 000000000..e69de29bb