Merge pull request #332 from Security-Onion-Solutions/feature/helixeps

adding helix eps count for telegraf

salt/common/telegraf/etc/telegraf.conf

@@ -655,6 +655,7 @@
     "/scripts/checkfiles.sh",
     "/scripts/broloss.sh",
     "/scripts/oldpcap.sh",
+    "/scripts/helixeps.sh",
   ]
   data_format = "influx"
 {% endif %}

salt/common/telegraf/scripts/helixeps.sh

@@ -0,0 +1,25 @@
+#!/bin/bash
+
+PREVCOUNTFILE='/tmp/helixevents.txt'
+EVENTCOUNTCURRENT="$(curl -s localhost:9600/_node/stats | jq '.pipelines.eval.events.out')"
+
+if [ ! -z "$EVENTCOUNTCURRENT" ]; then
+
+  if [ -f "$PREVCOUNTFILE" ]; then
+    EVENTCOUNTPREVIOUS=`cat $PREVCOUNTFILE`
+  else
+    echo "${EVENTCOUNTCURRENT}" > $PREVCOUNTFILE
+    exit 0
+  fi
+
+  echo "${EVENTCOUNTCURRENT}" > $PREVCOUNTFILE
+  EVENTS=$((EVENTCOUNTCURRENT - EVENTCOUNTPREVIOUS))
+  if [ "$EVENTS" -lt 0 ]; then
+    EVENTS=0
+  fi
+
+  echo "helixeps eps=${EVENTS}"
+
+fi
+
+exit 0