mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2025-12-06 09:12:45 +01:00
try to do it with just 1 cq, modify defaults for testing
This commit is contained in:
@@ -2,11 +2,11 @@ influxdb:
|
||||
retention_policies:
|
||||
autogen:
|
||||
default: True
|
||||
duration: 1d
|
||||
duration: 1h
|
||||
shard_duration: 1h
|
||||
so_long_term:
|
||||
default: False
|
||||
duration: 7d
|
||||
duration: 2d
|
||||
shard_duration: 1d
|
||||
downsample:
|
||||
so_long_term:
|
||||
|
||||
@@ -92,13 +92,14 @@ telegraf_database:
|
||||
- file: influxdb_retention_policy.present_patch
|
||||
{% endfor %}
|
||||
|
||||
{#
|
||||
{% for dest_rp in influxdb.downsample.keys() %}
|
||||
{% for measurement in influxdb.downsample[dest_rp].measurements %}
|
||||
so_downsample_{{measurement}}_cq:
|
||||
influxdb_continuous_query.present:
|
||||
- name: so_downsample_{{measurement}}_cq
|
||||
- database: telegraf
|
||||
- query: SELECT mean(*) INTO "{{dest_rp}}"."{{measurement}}" FROM "{{measurement}}" GROUP BY time({{influxdb.downsample[dest_rp].resolution}})
|
||||
- query: SELECT mean(*) INTO "{{dest_rp}}".:MEASUREMENT FROM "{{measurement}}" GROUP BY time({{influxdb.downsample[dest_rp].resolution}}), *
|
||||
- ssl: True
|
||||
- verify_ssl: /etc/pki/ca.crt
|
||||
- cert: ['/etc/pki/influxdb.crt', '/etc/pki/influxdb.key']
|
||||
@@ -109,6 +110,22 @@ so_downsample_{{measurement}}_cq:
|
||||
- file: influxdb_continuous_query.present_patch
|
||||
{% endfor %}
|
||||
{% endfor %}
|
||||
#}
|
||||
|
||||
so_downsample_cq:
|
||||
influxdb_continuous_query.present:
|
||||
- name: so_downsample_cq
|
||||
- database: telegraf
|
||||
- query: SELECT mean(*) INTO "{{dest_rp}}".:MEASUREMENT FROM /.*/ GROUP BY time({{influxdb.downsample[dest_rp].resolution}}),*
|
||||
- ssl: True
|
||||
- verify_ssl: /etc/pki/ca.crt
|
||||
- cert: ['/etc/pki/influxdb.crt', '/etc/pki/influxdb.key']
|
||||
- influxdb_host: {{ MANAGER }}
|
||||
- require:
|
||||
- docker_container: so-influxdb
|
||||
- influxdb_database: telegraf_database
|
||||
- file: influxdb_continuous_query.present_patch
|
||||
|
||||
|
||||
{% endif %}
|
||||
|
||||
|
||||
Reference in New Issue
Block a user