Fix system syslog delete file configuration

This commit is contained in:
weslambert
2023-03-13 17:10:52 -04:00
committed by GitHub
parent bb711a2a15
commit d5bb223235

View File

@@ -3,19 +3,19 @@
# https://securityonion.net/license; you may not use this file except in compliance with the # https://securityonion.net/license; you may not use this file except in compliance with the
# Elastic License 2.0. # Elastic License 2.0.
{%- set DELETE_DAYS = CURATORMERGED['logs-import-so'].delete %} {%- set DELETE_DAYS = CURATORMERGED['logs-system.syslog-default'].delete %}
actions: actions:
1: 1:
action: delete_indices action: delete_indices
description: >- description: >-
Delete import indices when older than {{ DELETE_DAYS }} days. Delete Elastic Agent system syslog indices when older than {{ DELETE_DAYS }} days.
options: options:
ignore_empty_list: True ignore_empty_list: True
disable_action: False disable_action: False
filters: filters:
- filtertype: pattern - filtertype: pattern
kind: regex kind: regex
value: '^(.ds-logs-import-so.*)$' value: '^(.ds-logs-system.syslog-default.*)$'
- filtertype: age - filtertype: age
source: name source: name
direction: older direction: older