mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2026-07-23 09:15:41 +02:00
add default templates for system integration metrics indices
This commit is contained in:
reyesj2
@@ -3453,6 +3453,720 @@ elasticsearch:
|
||||
set_priority:
|
||||
priority: 50
|
||||
min_age: 30d
|
||||
so-metrics-system_x_core:
|
||||
data_stream_lifecycle:
|
||||
data_retention: 90d
|
||||
index_template:
|
||||
composed_of:
|
||||
- metrics@tsdb-settings
|
||||
- metrics-system.core@package
|
||||
- metrics@custom
|
||||
- system@custom
|
||||
- metrics-system.core@custom
|
||||
- ecs@mappings
|
||||
- so-fleet_integrations.ip_mappings-1
|
||||
- so-fleet_globals-1
|
||||
- so-fleet_agent_id_verification-1
|
||||
data_stream:
|
||||
allow_custom_routing: false
|
||||
hidden: false
|
||||
ignore_missing_component_templates:
|
||||
- metrics@custom
|
||||
- system@custom
|
||||
- metrics-system.core@custom
|
||||
index_patterns:
|
||||
- metrics-system.core-*
|
||||
priority: 501
|
||||
template:
|
||||
settings:
|
||||
index:
|
||||
lifecycle:
|
||||
name: so-metrics-system.core-logs
|
||||
mode: time_series
|
||||
number_of_replicas: 0
|
||||
policy:
|
||||
phases:
|
||||
cold:
|
||||
actions:
|
||||
set_priority:
|
||||
priority: 0
|
||||
min_age: 60d
|
||||
delete:
|
||||
actions:
|
||||
delete: {}
|
||||
min_age: 365d
|
||||
hot:
|
||||
actions:
|
||||
rollover:
|
||||
max_age: 30d
|
||||
max_primary_shard_size: 50gb
|
||||
set_priority:
|
||||
priority: 100
|
||||
min_age: 0ms
|
||||
warm:
|
||||
actions:
|
||||
set_priority:
|
||||
priority: 50
|
||||
min_age: 30d
|
||||
so-metrics-system_x_cpu:
|
||||
data_stream_lifecycle:
|
||||
data_retention: 90d
|
||||
index_template:
|
||||
composed_of:
|
||||
- metrics@tsdb-settings
|
||||
- metrics-system.cpu@package
|
||||
- metrics@custom
|
||||
- system@custom
|
||||
- metrics-system.cpu@custom
|
||||
- ecs@mappings
|
||||
- so-fleet_integrations.ip_mappings-1
|
||||
- so-fleet_globals-1
|
||||
- so-fleet_agent_id_verification-1
|
||||
data_stream:
|
||||
allow_custom_routing: false
|
||||
hidden: false
|
||||
ignore_missing_component_templates:
|
||||
- metrics@custom
|
||||
- system@custom
|
||||
- metrics-system.cpu@custom
|
||||
index_patterns:
|
||||
- metrics-system.cpu-*
|
||||
priority: 501
|
||||
template:
|
||||
settings:
|
||||
index:
|
||||
lifecycle:
|
||||
name: so-metrics-system.cpu-logs
|
||||
mode: time_series
|
||||
number_of_replicas: 0
|
||||
policy:
|
||||
phases:
|
||||
cold:
|
||||
actions:
|
||||
set_priority:
|
||||
priority: 0
|
||||
min_age: 60d
|
||||
delete:
|
||||
actions:
|
||||
delete: {}
|
||||
min_age: 365d
|
||||
hot:
|
||||
actions:
|
||||
rollover:
|
||||
max_age: 30d
|
||||
max_primary_shard_size: 50gb
|
||||
set_priority:
|
||||
priority: 100
|
||||
min_age: 0ms
|
||||
warm:
|
||||
actions:
|
||||
set_priority:
|
||||
priority: 50
|
||||
min_age: 30d
|
||||
so-metrics-system_x_diskio:
|
||||
data_stream_lifecycle:
|
||||
data_retention: 90d
|
||||
index_template:
|
||||
composed_of:
|
||||
- metrics@tsdb-settings
|
||||
- metrics-system.diskio@package
|
||||
- metrics@custom
|
||||
- system@custom
|
||||
- metrics-system.diskio@custom
|
||||
- ecs@mappings
|
||||
- so-fleet_integrations.ip_mappings-1
|
||||
- so-fleet_globals-1
|
||||
- so-fleet_agent_id_verification-1
|
||||
data_stream:
|
||||
allow_custom_routing: false
|
||||
hidden: false
|
||||
ignore_missing_component_templates:
|
||||
- metrics@custom
|
||||
- system@custom
|
||||
- metrics-system.diskio@custom
|
||||
index_patterns:
|
||||
- metrics-system.diskio-*
|
||||
priority: 501
|
||||
template:
|
||||
settings:
|
||||
index:
|
||||
lifecycle:
|
||||
name: so-metrics-system.diskio-logs
|
||||
mode: time_series
|
||||
number_of_replicas: 0
|
||||
policy:
|
||||
phases:
|
||||
cold:
|
||||
actions:
|
||||
set_priority:
|
||||
priority: 0
|
||||
min_age: 60d
|
||||
delete:
|
||||
actions:
|
||||
delete: {}
|
||||
min_age: 365d
|
||||
hot:
|
||||
actions:
|
||||
rollover:
|
||||
max_age: 30d
|
||||
max_primary_shard_size: 50gb
|
||||
set_priority:
|
||||
priority: 100
|
||||
min_age: 0ms
|
||||
warm:
|
||||
actions:
|
||||
set_priority:
|
||||
priority: 50
|
||||
min_age: 30d
|
||||
so-metrics-system_x_filesystem:
|
||||
data_stream_lifecycle:
|
||||
data_retention: 90d
|
||||
index_template:
|
||||
composed_of:
|
||||
- metrics@tsdb-settings
|
||||
- metrics-system.filesystem@package
|
||||
- metrics@custom
|
||||
- system@custom
|
||||
- metrics-system.filesystem@custom
|
||||
- ecs@mappings
|
||||
- so-fleet_integrations.ip_mappings-1
|
||||
- so-fleet_globals-1
|
||||
- so-fleet_agent_id_verification-1
|
||||
data_stream:
|
||||
allow_custom_routing: false
|
||||
hidden: false
|
||||
ignore_missing_component_templates:
|
||||
- metrics@custom
|
||||
- system@custom
|
||||
- metrics-system.filesystem@custom
|
||||
index_patterns:
|
||||
- metrics-system.filesystem-*
|
||||
priority: 501
|
||||
template:
|
||||
settings:
|
||||
index:
|
||||
lifecycle:
|
||||
name: so-metrics-system.filesystem-logs
|
||||
mode: time_series
|
||||
number_of_replicas: 0
|
||||
policy:
|
||||
phases:
|
||||
cold:
|
||||
actions:
|
||||
set_priority:
|
||||
priority: 0
|
||||
min_age: 60d
|
||||
delete:
|
||||
actions:
|
||||
delete: {}
|
||||
min_age: 365d
|
||||
hot:
|
||||
actions:
|
||||
rollover:
|
||||
max_age: 30d
|
||||
max_primary_shard_size: 50gb
|
||||
set_priority:
|
||||
priority: 100
|
||||
min_age: 0ms
|
||||
warm:
|
||||
actions:
|
||||
set_priority:
|
||||
priority: 50
|
||||
min_age: 30d
|
||||
so-metrics-system_x_fsstat:
|
||||
data_stream_lifecycle:
|
||||
data_retention: 90d
|
||||
index_template:
|
||||
composed_of:
|
||||
- metrics@tsdb-settings
|
||||
- metrics-system.fsstat@package
|
||||
- metrics@custom
|
||||
- system@custom
|
||||
- metrics-system.fsstat@custom
|
||||
- ecs@mappings
|
||||
- so-fleet_integrations.ip_mappings-1
|
||||
- so-fleet_globals-1
|
||||
- so-fleet_agent_id_verification-1
|
||||
data_stream:
|
||||
allow_custom_routing: false
|
||||
hidden: false
|
||||
ignore_missing_component_templates:
|
||||
- metrics@custom
|
||||
- system@custom
|
||||
- metrics-system.fsstat@custom
|
||||
index_patterns:
|
||||
- metrics-system.fsstat-*
|
||||
priority: 501
|
||||
template:
|
||||
settings:
|
||||
index:
|
||||
lifecycle:
|
||||
name: so-metrics-system.fsstat-logs
|
||||
mode: time_series
|
||||
number_of_replicas: 0
|
||||
policy:
|
||||
phases:
|
||||
cold:
|
||||
actions:
|
||||
set_priority:
|
||||
priority: 0
|
||||
min_age: 60d
|
||||
delete:
|
||||
actions:
|
||||
delete: {}
|
||||
min_age: 365d
|
||||
hot:
|
||||
actions:
|
||||
rollover:
|
||||
max_age: 30d
|
||||
max_primary_shard_size: 50gb
|
||||
set_priority:
|
||||
priority: 100
|
||||
min_age: 0ms
|
||||
warm:
|
||||
actions:
|
||||
set_priority:
|
||||
priority: 50
|
||||
min_age: 30d
|
||||
so-metrics-system_x_load:
|
||||
data_stream_lifecycle:
|
||||
data_retention: 90d
|
||||
index_template:
|
||||
composed_of:
|
||||
- metrics@tsdb-settings
|
||||
- metrics-system.load@package
|
||||
- metrics@custom
|
||||
- system@custom
|
||||
- metrics-system.load@custom
|
||||
- ecs@mappings
|
||||
- so-fleet_integrations.ip_mappings-1
|
||||
- so-fleet_globals-1
|
||||
- so-fleet_agent_id_verification-1
|
||||
data_stream:
|
||||
allow_custom_routing: false
|
||||
hidden: false
|
||||
ignore_missing_component_templates:
|
||||
- metrics@custom
|
||||
- system@custom
|
||||
- metrics-system.load@custom
|
||||
index_patterns:
|
||||
- metrics-system.load-*
|
||||
priority: 501
|
||||
template:
|
||||
settings:
|
||||
index:
|
||||
lifecycle:
|
||||
name: so-metrics-system.load-logs
|
||||
mode: time_series
|
||||
number_of_replicas: 0
|
||||
policy:
|
||||
phases:
|
||||
cold:
|
||||
actions:
|
||||
set_priority:
|
||||
priority: 0
|
||||
min_age: 60d
|
||||
delete:
|
||||
actions:
|
||||
delete: {}
|
||||
min_age: 365d
|
||||
hot:
|
||||
actions:
|
||||
rollover:
|
||||
max_age: 30d
|
||||
max_primary_shard_size: 50gb
|
||||
set_priority:
|
||||
priority: 100
|
||||
min_age: 0ms
|
||||
warm:
|
||||
actions:
|
||||
set_priority:
|
||||
priority: 50
|
||||
min_age: 30d
|
||||
so-metrics-system_x_memory:
|
||||
data_stream_lifecycle:
|
||||
data_retention: 90d
|
||||
index_template:
|
||||
composed_of:
|
||||
- metrics@tsdb-settings
|
||||
- metrics-system.memory@package
|
||||
- metrics@custom
|
||||
- system@custom
|
||||
- metrics-system.memory@custom
|
||||
- ecs@mappings
|
||||
- so-fleet_integrations.ip_mappings-1
|
||||
- so-fleet_globals-1
|
||||
- so-fleet_agent_id_verification-1
|
||||
data_stream:
|
||||
allow_custom_routing: false
|
||||
hidden: false
|
||||
ignore_missing_component_templates:
|
||||
- metrics@custom
|
||||
- system@custom
|
||||
- metrics-system.memory@custom
|
||||
index_patterns:
|
||||
- metrics-system.memory-*
|
||||
priority: 501
|
||||
template:
|
||||
settings:
|
||||
index:
|
||||
lifecycle:
|
||||
name: so-metrics-system.memory-logs
|
||||
mode: time_series
|
||||
number_of_replicas: 0
|
||||
policy:
|
||||
phases:
|
||||
cold:
|
||||
actions:
|
||||
set_priority:
|
||||
priority: 0
|
||||
min_age: 60d
|
||||
delete:
|
||||
actions:
|
||||
delete: {}
|
||||
min_age: 365d
|
||||
hot:
|
||||
actions:
|
||||
rollover:
|
||||
max_age: 30d
|
||||
max_primary_shard_size: 50gb
|
||||
set_priority:
|
||||
priority: 100
|
||||
min_age: 0ms
|
||||
warm:
|
||||
actions:
|
||||
set_priority:
|
||||
priority: 50
|
||||
min_age: 30d
|
||||
so-metrics-system_x_network:
|
||||
data_stream_lifecycle:
|
||||
data_retention: 90d
|
||||
index_template:
|
||||
composed_of:
|
||||
- metrics@tsdb-settings
|
||||
- metrics-system.network@package
|
||||
- metrics@custom
|
||||
- system@custom
|
||||
- metrics-system.network@custom
|
||||
- ecs@mappings
|
||||
- so-fleet_integrations.ip_mappings-1
|
||||
- so-fleet_globals-1
|
||||
- so-fleet_agent_id_verification-1
|
||||
data_stream:
|
||||
allow_custom_routing: false
|
||||
hidden: false
|
||||
ignore_missing_component_templates:
|
||||
- metrics@custom
|
||||
- system@custom
|
||||
- metrics-system.network@custom
|
||||
index_patterns:
|
||||
- metrics-system.network-*
|
||||
priority: 501
|
||||
template:
|
||||
settings:
|
||||
index:
|
||||
lifecycle:
|
||||
name: so-metrics-system.network-logs
|
||||
mode: time_series
|
||||
number_of_replicas: 0
|
||||
policy:
|
||||
phases:
|
||||
cold:
|
||||
actions:
|
||||
set_priority:
|
||||
priority: 0
|
||||
min_age: 60d
|
||||
delete:
|
||||
actions:
|
||||
delete: {}
|
||||
min_age: 365d
|
||||
hot:
|
||||
actions:
|
||||
rollover:
|
||||
max_age: 30d
|
||||
max_primary_shard_size: 50gb
|
||||
set_priority:
|
||||
priority: 100
|
||||
min_age: 0ms
|
||||
warm:
|
||||
actions:
|
||||
set_priority:
|
||||
priority: 50
|
||||
min_age: 30d
|
||||
so-metrics-system_x_ntp:
|
||||
data_stream_lifecycle:
|
||||
data_retention: 90d
|
||||
index_template:
|
||||
composed_of:
|
||||
- metrics@settings
|
||||
- metrics-system.ntp@package
|
||||
- metrics@custom
|
||||
- system@custom
|
||||
- metrics-system.ntp@custom
|
||||
- ecs@mappings
|
||||
- so-fleet_integrations.ip_mappings-1
|
||||
- so-fleet_globals-1
|
||||
- so-fleet_agent_id_verification-1
|
||||
data_stream:
|
||||
allow_custom_routing: false
|
||||
hidden: false
|
||||
ignore_missing_component_templates:
|
||||
- metrics@custom
|
||||
- system@custom
|
||||
- metrics-system.ntp@custom
|
||||
index_patterns:
|
||||
- metrics-system.ntp-*
|
||||
priority: 501
|
||||
template:
|
||||
settings:
|
||||
index:
|
||||
lifecycle:
|
||||
name: so-metrics-system.ntp-logs
|
||||
number_of_replicas: 0
|
||||
policy:
|
||||
phases:
|
||||
cold:
|
||||
actions:
|
||||
set_priority:
|
||||
priority: 0
|
||||
min_age: 60d
|
||||
delete:
|
||||
actions:
|
||||
delete: {}
|
||||
min_age: 365d
|
||||
hot:
|
||||
actions:
|
||||
rollover:
|
||||
max_age: 30d
|
||||
max_primary_shard_size: 50gb
|
||||
set_priority:
|
||||
priority: 100
|
||||
min_age: 0ms
|
||||
warm:
|
||||
actions:
|
||||
set_priority:
|
||||
priority: 50
|
||||
min_age: 30d
|
||||
so-metrics-system_x_process:
|
||||
data_stream_lifecycle:
|
||||
data_retention: 90d
|
||||
index_template:
|
||||
composed_of:
|
||||
- metrics@tsdb-settings
|
||||
- metrics-system.process@package
|
||||
- metrics@custom
|
||||
- system@custom
|
||||
- metrics-system.process@custom
|
||||
- ecs@mappings
|
||||
- so-fleet_integrations.ip_mappings-1
|
||||
- so-fleet_globals-1
|
||||
- so-fleet_agent_id_verification-1
|
||||
data_stream:
|
||||
allow_custom_routing: false
|
||||
hidden: false
|
||||
ignore_missing_component_templates:
|
||||
- metrics@custom
|
||||
- system@custom
|
||||
- metrics-system.process@custom
|
||||
index_patterns:
|
||||
- metrics-system.process-*
|
||||
priority: 501
|
||||
template:
|
||||
settings:
|
||||
index:
|
||||
lifecycle:
|
||||
name: so-metrics-system.process-logs
|
||||
mode: time_series
|
||||
number_of_replicas: 0
|
||||
policy:
|
||||
phases:
|
||||
cold:
|
||||
actions:
|
||||
set_priority:
|
||||
priority: 0
|
||||
min_age: 60d
|
||||
delete:
|
||||
actions:
|
||||
delete: {}
|
||||
min_age: 365d
|
||||
hot:
|
||||
actions:
|
||||
rollover:
|
||||
max_age: 30d
|
||||
max_primary_shard_size: 50gb
|
||||
set_priority:
|
||||
priority: 100
|
||||
min_age: 0ms
|
||||
warm:
|
||||
actions:
|
||||
set_priority:
|
||||
priority: 50
|
||||
min_age: 30d
|
||||
so-metrics-system_x_process_x_summary:
|
||||
data_stream_lifecycle:
|
||||
data_retention: 90d
|
||||
index_template:
|
||||
composed_of:
|
||||
- metrics@tsdb-settings
|
||||
- metrics-system.process.summary@package
|
||||
- metrics@custom
|
||||
- system@custom
|
||||
- metrics-system.process.summary@custom
|
||||
- ecs@mappings
|
||||
- so-fleet_integrations.ip_mappings-1
|
||||
- so-fleet_globals-1
|
||||
- so-fleet_agent_id_verification-1
|
||||
data_stream:
|
||||
allow_custom_routing: false
|
||||
hidden: false
|
||||
ignore_missing_component_templates:
|
||||
- metrics@custom
|
||||
- system@custom
|
||||
- metrics-system.process.summary@custom
|
||||
index_patterns:
|
||||
- metrics-system.process.summary-*
|
||||
priority: 501
|
||||
template:
|
||||
settings:
|
||||
index:
|
||||
lifecycle:
|
||||
name: so-metrics-system.process.summary-logs
|
||||
mode: time_series
|
||||
number_of_replicas: 0
|
||||
policy:
|
||||
phases:
|
||||
cold:
|
||||
actions:
|
||||
set_priority:
|
||||
priority: 0
|
||||
min_age: 60d
|
||||
delete:
|
||||
actions:
|
||||
delete: {}
|
||||
min_age: 365d
|
||||
hot:
|
||||
actions:
|
||||
rollover:
|
||||
max_age: 30d
|
||||
max_primary_shard_size: 50gb
|
||||
set_priority:
|
||||
priority: 100
|
||||
min_age: 0ms
|
||||
warm:
|
||||
actions:
|
||||
set_priority:
|
||||
priority: 50
|
||||
min_age: 30d
|
||||
so-metrics-system_x_socket_summary:
|
||||
data_stream_lifecycle:
|
||||
data_retention: 90d
|
||||
index_template:
|
||||
composed_of:
|
||||
- metrics@tsdb-settings
|
||||
- metrics-system.socket_summary@package
|
||||
- metrics@custom
|
||||
- system@custom
|
||||
- metrics-system.socket_summary@custom
|
||||
- ecs@mappings
|
||||
- so-fleet_integrations.ip_mappings-1
|
||||
- so-fleet_globals-1
|
||||
- so-fleet_agent_id_verification-1
|
||||
data_stream:
|
||||
allow_custom_routing: false
|
||||
hidden: false
|
||||
ignore_missing_component_templates:
|
||||
- metrics@custom
|
||||
- system@custom
|
||||
- metrics-system.socket_summary@custom
|
||||
index_patterns:
|
||||
- metrics-system.socket_summary-*
|
||||
priority: 501
|
||||
template:
|
||||
settings:
|
||||
index:
|
||||
lifecycle:
|
||||
name: so-metrics-system.socket_summary-logs
|
||||
mode: time_series
|
||||
number_of_replicas: 0
|
||||
policy:
|
||||
phases:
|
||||
cold:
|
||||
actions:
|
||||
set_priority:
|
||||
priority: 0
|
||||
min_age: 60d
|
||||
delete:
|
||||
actions:
|
||||
delete: {}
|
||||
min_age: 365d
|
||||
hot:
|
||||
actions:
|
||||
rollover:
|
||||
max_age: 30d
|
||||
max_primary_shard_size: 50gb
|
||||
set_priority:
|
||||
priority: 100
|
||||
min_age: 0ms
|
||||
warm:
|
||||
actions:
|
||||
set_priority:
|
||||
priority: 50
|
||||
min_age: 30d
|
||||
so-metrics-system_x_uptime:
|
||||
data_stream_lifecycle:
|
||||
data_retention: 90d
|
||||
index_template:
|
||||
composed_of:
|
||||
- metrics@tsdb-settings
|
||||
- metrics-system.uptime@package
|
||||
- metrics@custom
|
||||
- system@custom
|
||||
- metrics-system.uptime@custom
|
||||
- ecs@mappings
|
||||
- so-fleet_integrations.ip_mappings-1
|
||||
- so-fleet_globals-1
|
||||
- so-fleet_agent_id_verification-1
|
||||
data_stream:
|
||||
allow_custom_routing: false
|
||||
hidden: false
|
||||
ignore_missing_component_templates:
|
||||
- metrics@custom
|
||||
- system@custom
|
||||
- metrics-system.uptime@custom
|
||||
index_patterns:
|
||||
- metrics-system.uptime-*
|
||||
priority: 501
|
||||
template:
|
||||
settings:
|
||||
index:
|
||||
lifecycle:
|
||||
name: so-metrics-system.uptime-logs
|
||||
mode: time_series
|
||||
number_of_replicas: 0
|
||||
policy:
|
||||
phases:
|
||||
cold:
|
||||
actions:
|
||||
set_priority:
|
||||
priority: 0
|
||||
min_age: 60d
|
||||
delete:
|
||||
actions:
|
||||
delete: {}
|
||||
min_age: 365d
|
||||
hot:
|
||||
actions:
|
||||
rollover:
|
||||
max_age: 30d
|
||||
max_primary_shard_size: 50gb
|
||||
set_priority:
|
||||
priority: 100
|
||||
min_age: 0ms
|
||||
warm:
|
||||
actions:
|
||||
set_priority:
|
||||
priority: 50
|
||||
min_age: 30d
|
||||
so-logs-windows_x_forwarded:
|
||||
index_sorting: false
|
||||
data_stream_lifecycle:
|
||||
|
||||
@@ -697,6 +697,19 @@ elasticsearch:
|
||||
so-metrics-vsphere_x_datastore: *dataStreamSettings
|
||||
so-metrics-vsphere_x_host: *dataStreamSettings
|
||||
so-metrics-vsphere_x_virtualmachine: *dataStreamSettings
|
||||
so-metrics-system_x_core: *dataStreamSettings
|
||||
so-metrics-system_x_cpu: *dataStreamSettings
|
||||
so-metrics-system_x_diskio: *dataStreamSettings
|
||||
so-metrics-system_x_filesystem: *dataStreamSettings
|
||||
so-metrics-system_x_fsstat: *dataStreamSettings
|
||||
so-metrics-system_x_load: *dataStreamSettings
|
||||
so-metrics-system_x_memory: *dataStreamSettings
|
||||
so-metrics-system_x_network: *dataStreamSettings
|
||||
so-metrics-system_x_ntp: *dataStreamSettings
|
||||
so-metrics-system_x_process: *dataStreamSettings
|
||||
so-metrics-system_x_process_x_summary: *dataStreamSettings
|
||||
so-metrics-system_x_socket_summary: *dataStreamSettings
|
||||
so-metrics-system_x_uptime: *dataStreamSettings
|
||||
so-common: *dataStreamSettings
|
||||
so-endgame: *dataStreamSettings
|
||||
so-idh: *dataStreamSettings
|
||||
|
||||
Reference in New Issue
Block a user