mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2025-12-08 18:22:47 +01:00
try to do it with just 1 cq, modify defaults for testing
This commit is contained in:
@@ -2,11 +2,11 @@ influxdb:
|
|||||||
retention_policies:
|
retention_policies:
|
||||||
autogen:
|
autogen:
|
||||||
default: True
|
default: True
|
||||||
duration: 1d
|
duration: 1h
|
||||||
shard_duration: 1h
|
shard_duration: 1h
|
||||||
so_long_term:
|
so_long_term:
|
||||||
default: False
|
default: False
|
||||||
duration: 7d
|
duration: 2d
|
||||||
shard_duration: 1d
|
shard_duration: 1d
|
||||||
downsample:
|
downsample:
|
||||||
so_long_term:
|
so_long_term:
|
||||||
|
|||||||
@@ -92,13 +92,14 @@ telegraf_database:
|
|||||||
- file: influxdb_retention_policy.present_patch
|
- file: influxdb_retention_policy.present_patch
|
||||||
{% endfor %}
|
{% endfor %}
|
||||||
|
|
||||||
|
{#
|
||||||
{% for dest_rp in influxdb.downsample.keys() %}
|
{% for dest_rp in influxdb.downsample.keys() %}
|
||||||
{% for measurement in influxdb.downsample[dest_rp].measurements %}
|
{% for measurement in influxdb.downsample[dest_rp].measurements %}
|
||||||
so_downsample_{{measurement}}_cq:
|
so_downsample_{{measurement}}_cq:
|
||||||
influxdb_continuous_query.present:
|
influxdb_continuous_query.present:
|
||||||
- name: so_downsample_{{measurement}}_cq
|
- name: so_downsample_{{measurement}}_cq
|
||||||
- database: telegraf
|
- database: telegraf
|
||||||
- query: SELECT mean(*) INTO "{{dest_rp}}"."{{measurement}}" FROM "{{measurement}}" GROUP BY time({{influxdb.downsample[dest_rp].resolution}})
|
- query: SELECT mean(*) INTO "{{dest_rp}}".:MEASUREMENT FROM "{{measurement}}" GROUP BY time({{influxdb.downsample[dest_rp].resolution}}), *
|
||||||
- ssl: True
|
- ssl: True
|
||||||
- verify_ssl: /etc/pki/ca.crt
|
- verify_ssl: /etc/pki/ca.crt
|
||||||
- cert: ['/etc/pki/influxdb.crt', '/etc/pki/influxdb.key']
|
- cert: ['/etc/pki/influxdb.crt', '/etc/pki/influxdb.key']
|
||||||
@@ -109,6 +110,22 @@ so_downsample_{{measurement}}_cq:
|
|||||||
- file: influxdb_continuous_query.present_patch
|
- file: influxdb_continuous_query.present_patch
|
||||||
{% endfor %}
|
{% endfor %}
|
||||||
{% endfor %}
|
{% endfor %}
|
||||||
|
#}
|
||||||
|
|
||||||
|
so_downsample_cq:
|
||||||
|
influxdb_continuous_query.present:
|
||||||
|
- name: so_downsample_cq
|
||||||
|
- database: telegraf
|
||||||
|
- query: SELECT mean(*) INTO "{{dest_rp}}".:MEASUREMENT FROM /.*/ GROUP BY time({{influxdb.downsample[dest_rp].resolution}}),*
|
||||||
|
- ssl: True
|
||||||
|
- verify_ssl: /etc/pki/ca.crt
|
||||||
|
- cert: ['/etc/pki/influxdb.crt', '/etc/pki/influxdb.key']
|
||||||
|
- influxdb_host: {{ MANAGER }}
|
||||||
|
- require:
|
||||||
|
- docker_container: so-influxdb
|
||||||
|
- influxdb_database: telegraf_database
|
||||||
|
- file: influxdb_continuous_query.present_patch
|
||||||
|
|
||||||
|
|
||||||
{% endif %}
|
{% endif %}
|
||||||
|
|
||||||
|
|||||||
Reference in New Issue
Block a user