mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2025-12-06 17:22:49 +01:00
Fix system syslog delete file configuration
This commit is contained in:
@@ -3,19 +3,19 @@
|
|||||||
# https://securityonion.net/license; you may not use this file except in compliance with the
|
# https://securityonion.net/license; you may not use this file except in compliance with the
|
||||||
# Elastic License 2.0.
|
# Elastic License 2.0.
|
||||||
|
|
||||||
{%- set DELETE_DAYS = CURATORMERGED['logs-import-so'].delete %}
|
{%- set DELETE_DAYS = CURATORMERGED['logs-system.syslog-default'].delete %}
|
||||||
actions:
|
actions:
|
||||||
1:
|
1:
|
||||||
action: delete_indices
|
action: delete_indices
|
||||||
description: >-
|
description: >-
|
||||||
Delete import indices when older than {{ DELETE_DAYS }} days.
|
Delete Elastic Agent system syslog indices when older than {{ DELETE_DAYS }} days.
|
||||||
options:
|
options:
|
||||||
ignore_empty_list: True
|
ignore_empty_list: True
|
||||||
disable_action: False
|
disable_action: False
|
||||||
filters:
|
filters:
|
||||||
- filtertype: pattern
|
- filtertype: pattern
|
||||||
kind: regex
|
kind: regex
|
||||||
value: '^(.ds-logs-import-so.*)$'
|
value: '^(.ds-logs-system.syslog-default.*)$'
|
||||||
- filtertype: age
|
- filtertype: age
|
||||||
source: name
|
source: name
|
||||||
direction: older
|
direction: older
|
||||||
|
|||||||
Reference in New Issue
Block a user