From f4aa9932ffef0ee7a91a104f513e1305ff36097a Mon Sep 17 00:00:00 2001 From: reyesj2 <94730068+reyesj2@users.noreply.github.com> Date: Wed, 22 Jul 2026 12:13:45 -0500 Subject: [PATCH] add default templates for system integration metrics indices --- salt/elasticsearch/defaults.yaml | 714 ++++++++++++++++++++++ salt/elasticsearch/soc_elasticsearch.yaml | 13 + 2 files changed, 727 insertions(+) diff --git a/salt/elasticsearch/defaults.yaml b/salt/elasticsearch/defaults.yaml index 14d753c21..5179fac2b 100644 --- a/salt/elasticsearch/defaults.yaml +++ b/salt/elasticsearch/defaults.yaml @@ -3453,6 +3453,720 @@ elasticsearch: set_priority: priority: 50 min_age: 30d + so-metrics-system_x_core: + data_stream_lifecycle: + data_retention: 90d + index_template: + composed_of: + - metrics@tsdb-settings + - metrics-system.core@package + - metrics@custom + - system@custom + - metrics-system.core@custom + - ecs@mappings + - so-fleet_integrations.ip_mappings-1 + - so-fleet_globals-1 + - so-fleet_agent_id_verification-1 + data_stream: + allow_custom_routing: false + hidden: false + ignore_missing_component_templates: + - metrics@custom + - system@custom + - metrics-system.core@custom + index_patterns: + - metrics-system.core-* + priority: 501 + template: + settings: + index: + lifecycle: + name: so-metrics-system.core-logs + mode: time_series + number_of_replicas: 0 + policy: + phases: + cold: + actions: + set_priority: + priority: 0 + min_age: 60d + delete: + actions: + delete: {} + min_age: 365d + hot: + actions: + rollover: + max_age: 30d + max_primary_shard_size: 50gb + set_priority: + priority: 100 + min_age: 0ms + warm: + actions: + set_priority: + priority: 50 + min_age: 30d + so-metrics-system_x_cpu: + data_stream_lifecycle: + data_retention: 90d + index_template: + composed_of: + - metrics@tsdb-settings + - metrics-system.cpu@package + - metrics@custom + - system@custom + - metrics-system.cpu@custom + - ecs@mappings + - so-fleet_integrations.ip_mappings-1 + - so-fleet_globals-1 + - so-fleet_agent_id_verification-1 + data_stream: + allow_custom_routing: false + hidden: false + ignore_missing_component_templates: + - metrics@custom + - system@custom + - metrics-system.cpu@custom + index_patterns: + - metrics-system.cpu-* + priority: 501 + template: + settings: + index: + lifecycle: + name: so-metrics-system.cpu-logs + mode: time_series + number_of_replicas: 0 + policy: + phases: + cold: + actions: + set_priority: + priority: 0 + min_age: 60d + delete: + actions: + delete: {} + min_age: 365d + hot: + actions: + rollover: + max_age: 30d + max_primary_shard_size: 50gb + set_priority: + priority: 100 + min_age: 0ms + warm: + actions: + set_priority: + priority: 50 + min_age: 30d + so-metrics-system_x_diskio: + data_stream_lifecycle: + data_retention: 90d + index_template: + composed_of: + - metrics@tsdb-settings + - metrics-system.diskio@package + - metrics@custom + - system@custom + - metrics-system.diskio@custom + - ecs@mappings + - so-fleet_integrations.ip_mappings-1 + - so-fleet_globals-1 + - so-fleet_agent_id_verification-1 + data_stream: + allow_custom_routing: false + hidden: false + ignore_missing_component_templates: + - metrics@custom + - system@custom + - metrics-system.diskio@custom + index_patterns: + - metrics-system.diskio-* + priority: 501 + template: + settings: + index: + lifecycle: + name: so-metrics-system.diskio-logs + mode: time_series + number_of_replicas: 0 + policy: + phases: + cold: + actions: + set_priority: + priority: 0 + min_age: 60d + delete: + actions: + delete: {} + min_age: 365d + hot: + actions: + rollover: + max_age: 30d + max_primary_shard_size: 50gb + set_priority: + priority: 100 + min_age: 0ms + warm: + actions: + set_priority: + priority: 50 + min_age: 30d + so-metrics-system_x_filesystem: + data_stream_lifecycle: + data_retention: 90d + index_template: + composed_of: + - metrics@tsdb-settings + - metrics-system.filesystem@package + - metrics@custom + - system@custom + - metrics-system.filesystem@custom + - ecs@mappings + - so-fleet_integrations.ip_mappings-1 + - so-fleet_globals-1 + - so-fleet_agent_id_verification-1 + data_stream: + allow_custom_routing: false + hidden: false + ignore_missing_component_templates: + - metrics@custom + - system@custom + - metrics-system.filesystem@custom + index_patterns: + - metrics-system.filesystem-* + priority: 501 + template: + settings: + index: + lifecycle: + name: so-metrics-system.filesystem-logs + mode: time_series + number_of_replicas: 0 + policy: + phases: + cold: + actions: + set_priority: + priority: 0 + min_age: 60d + delete: + actions: + delete: {} + min_age: 365d + hot: + actions: + rollover: + max_age: 30d + max_primary_shard_size: 50gb + set_priority: + priority: 100 + min_age: 0ms + warm: + actions: + set_priority: + priority: 50 + min_age: 30d + so-metrics-system_x_fsstat: + data_stream_lifecycle: + data_retention: 90d + index_template: + composed_of: + - metrics@tsdb-settings + - metrics-system.fsstat@package + - metrics@custom + - system@custom + - metrics-system.fsstat@custom + - ecs@mappings + - so-fleet_integrations.ip_mappings-1 + - so-fleet_globals-1 + - so-fleet_agent_id_verification-1 + data_stream: + allow_custom_routing: false + hidden: false + ignore_missing_component_templates: + - metrics@custom + - system@custom + - metrics-system.fsstat@custom + index_patterns: + - metrics-system.fsstat-* + priority: 501 + template: + settings: + index: + lifecycle: + name: so-metrics-system.fsstat-logs + mode: time_series + number_of_replicas: 0 + policy: + phases: + cold: + actions: + set_priority: + priority: 0 + min_age: 60d + delete: + actions: + delete: {} + min_age: 365d + hot: + actions: + rollover: + max_age: 30d + max_primary_shard_size: 50gb + set_priority: + priority: 100 + min_age: 0ms + warm: + actions: + set_priority: + priority: 50 + min_age: 30d + so-metrics-system_x_load: + data_stream_lifecycle: + data_retention: 90d + index_template: + composed_of: + - metrics@tsdb-settings + - metrics-system.load@package + - metrics@custom + - system@custom + - metrics-system.load@custom + - ecs@mappings + - so-fleet_integrations.ip_mappings-1 + - so-fleet_globals-1 + - so-fleet_agent_id_verification-1 + data_stream: + allow_custom_routing: false + hidden: false + ignore_missing_component_templates: + - metrics@custom + - system@custom + - metrics-system.load@custom + index_patterns: + - metrics-system.load-* + priority: 501 + template: + settings: + index: + lifecycle: + name: so-metrics-system.load-logs + mode: time_series + number_of_replicas: 0 + policy: + phases: + cold: + actions: + set_priority: + priority: 0 + min_age: 60d + delete: + actions: + delete: {} + min_age: 365d + hot: + actions: + rollover: + max_age: 30d + max_primary_shard_size: 50gb + set_priority: + priority: 100 + min_age: 0ms + warm: + actions: + set_priority: + priority: 50 + min_age: 30d + so-metrics-system_x_memory: + data_stream_lifecycle: + data_retention: 90d + index_template: + composed_of: + - metrics@tsdb-settings + - metrics-system.memory@package + - metrics@custom + - system@custom + - metrics-system.memory@custom + - ecs@mappings + - so-fleet_integrations.ip_mappings-1 + - so-fleet_globals-1 + - so-fleet_agent_id_verification-1 + data_stream: + allow_custom_routing: false + hidden: false + ignore_missing_component_templates: + - metrics@custom + - system@custom + - metrics-system.memory@custom + index_patterns: + - metrics-system.memory-* + priority: 501 + template: + settings: + index: + lifecycle: + name: so-metrics-system.memory-logs + mode: time_series + number_of_replicas: 0 + policy: + phases: + cold: + actions: + set_priority: + priority: 0 + min_age: 60d + delete: + actions: + delete: {} + min_age: 365d + hot: + actions: + rollover: + max_age: 30d + max_primary_shard_size: 50gb + set_priority: + priority: 100 + min_age: 0ms + warm: + actions: + set_priority: + priority: 50 + min_age: 30d + so-metrics-system_x_network: + data_stream_lifecycle: + data_retention: 90d + index_template: + composed_of: + - metrics@tsdb-settings + - metrics-system.network@package + - metrics@custom + - system@custom + - metrics-system.network@custom + - ecs@mappings + - so-fleet_integrations.ip_mappings-1 + - so-fleet_globals-1 + - so-fleet_agent_id_verification-1 + data_stream: + allow_custom_routing: false + hidden: false + ignore_missing_component_templates: + - metrics@custom + - system@custom + - metrics-system.network@custom + index_patterns: + - metrics-system.network-* + priority: 501 + template: + settings: + index: + lifecycle: + name: so-metrics-system.network-logs + mode: time_series + number_of_replicas: 0 + policy: + phases: + cold: + actions: + set_priority: + priority: 0 + min_age: 60d + delete: + actions: + delete: {} + min_age: 365d + hot: + actions: + rollover: + max_age: 30d + max_primary_shard_size: 50gb + set_priority: + priority: 100 + min_age: 0ms + warm: + actions: + set_priority: + priority: 50 + min_age: 30d + so-metrics-system_x_ntp: + data_stream_lifecycle: + data_retention: 90d + index_template: + composed_of: + - metrics@settings + - metrics-system.ntp@package + - metrics@custom + - system@custom + - metrics-system.ntp@custom + - ecs@mappings + - so-fleet_integrations.ip_mappings-1 + - so-fleet_globals-1 + - so-fleet_agent_id_verification-1 + data_stream: + allow_custom_routing: false + hidden: false + ignore_missing_component_templates: + - metrics@custom + - system@custom + - metrics-system.ntp@custom + index_patterns: + - metrics-system.ntp-* + priority: 501 + template: + settings: + index: + lifecycle: + name: so-metrics-system.ntp-logs + number_of_replicas: 0 + policy: + phases: + cold: + actions: + set_priority: + priority: 0 + min_age: 60d + delete: + actions: + delete: {} + min_age: 365d + hot: + actions: + rollover: + max_age: 30d + max_primary_shard_size: 50gb + set_priority: + priority: 100 + min_age: 0ms + warm: + actions: + set_priority: + priority: 50 + min_age: 30d + so-metrics-system_x_process: + data_stream_lifecycle: + data_retention: 90d + index_template: + composed_of: + - metrics@tsdb-settings + - metrics-system.process@package + - metrics@custom + - system@custom + - metrics-system.process@custom + - ecs@mappings + - so-fleet_integrations.ip_mappings-1 + - so-fleet_globals-1 + - so-fleet_agent_id_verification-1 + data_stream: + allow_custom_routing: false + hidden: false + ignore_missing_component_templates: + - metrics@custom + - system@custom + - metrics-system.process@custom + index_patterns: + - metrics-system.process-* + priority: 501 + template: + settings: + index: + lifecycle: + name: so-metrics-system.process-logs + mode: time_series + number_of_replicas: 0 + policy: + phases: + cold: + actions: + set_priority: + priority: 0 + min_age: 60d + delete: + actions: + delete: {} + min_age: 365d + hot: + actions: + rollover: + max_age: 30d + max_primary_shard_size: 50gb + set_priority: + priority: 100 + min_age: 0ms + warm: + actions: + set_priority: + priority: 50 + min_age: 30d + so-metrics-system_x_process_x_summary: + data_stream_lifecycle: + data_retention: 90d + index_template: + composed_of: + - metrics@tsdb-settings + - metrics-system.process.summary@package + - metrics@custom + - system@custom + - metrics-system.process.summary@custom + - ecs@mappings + - so-fleet_integrations.ip_mappings-1 + - so-fleet_globals-1 + - so-fleet_agent_id_verification-1 + data_stream: + allow_custom_routing: false + hidden: false + ignore_missing_component_templates: + - metrics@custom + - system@custom + - metrics-system.process.summary@custom + index_patterns: + - metrics-system.process.summary-* + priority: 501 + template: + settings: + index: + lifecycle: + name: so-metrics-system.process.summary-logs + mode: time_series + number_of_replicas: 0 + policy: + phases: + cold: + actions: + set_priority: + priority: 0 + min_age: 60d + delete: + actions: + delete: {} + min_age: 365d + hot: + actions: + rollover: + max_age: 30d + max_primary_shard_size: 50gb + set_priority: + priority: 100 + min_age: 0ms + warm: + actions: + set_priority: + priority: 50 + min_age: 30d + so-metrics-system_x_socket_summary: + data_stream_lifecycle: + data_retention: 90d + index_template: + composed_of: + - metrics@tsdb-settings + - metrics-system.socket_summary@package + - metrics@custom + - system@custom + - metrics-system.socket_summary@custom + - ecs@mappings + - so-fleet_integrations.ip_mappings-1 + - so-fleet_globals-1 + - so-fleet_agent_id_verification-1 + data_stream: + allow_custom_routing: false + hidden: false + ignore_missing_component_templates: + - metrics@custom + - system@custom + - metrics-system.socket_summary@custom + index_patterns: + - metrics-system.socket_summary-* + priority: 501 + template: + settings: + index: + lifecycle: + name: so-metrics-system.socket_summary-logs + mode: time_series + number_of_replicas: 0 + policy: + phases: + cold: + actions: + set_priority: + priority: 0 + min_age: 60d + delete: + actions: + delete: {} + min_age: 365d + hot: + actions: + rollover: + max_age: 30d + max_primary_shard_size: 50gb + set_priority: + priority: 100 + min_age: 0ms + warm: + actions: + set_priority: + priority: 50 + min_age: 30d + so-metrics-system_x_uptime: + data_stream_lifecycle: + data_retention: 90d + index_template: + composed_of: + - metrics@tsdb-settings + - metrics-system.uptime@package + - metrics@custom + - system@custom + - metrics-system.uptime@custom + - ecs@mappings + - so-fleet_integrations.ip_mappings-1 + - so-fleet_globals-1 + - so-fleet_agent_id_verification-1 + data_stream: + allow_custom_routing: false + hidden: false + ignore_missing_component_templates: + - metrics@custom + - system@custom + - metrics-system.uptime@custom + index_patterns: + - metrics-system.uptime-* + priority: 501 + template: + settings: + index: + lifecycle: + name: so-metrics-system.uptime-logs + mode: time_series + number_of_replicas: 0 + policy: + phases: + cold: + actions: + set_priority: + priority: 0 + min_age: 60d + delete: + actions: + delete: {} + min_age: 365d + hot: + actions: + rollover: + max_age: 30d + max_primary_shard_size: 50gb + set_priority: + priority: 100 + min_age: 0ms + warm: + actions: + set_priority: + priority: 50 + min_age: 30d so-logs-windows_x_forwarded: index_sorting: false data_stream_lifecycle: diff --git a/salt/elasticsearch/soc_elasticsearch.yaml b/salt/elasticsearch/soc_elasticsearch.yaml index bf5b665c3..ef9c066d3 100644 --- a/salt/elasticsearch/soc_elasticsearch.yaml +++ b/salt/elasticsearch/soc_elasticsearch.yaml @@ -697,6 +697,19 @@ elasticsearch: so-metrics-vsphere_x_datastore: *dataStreamSettings so-metrics-vsphere_x_host: *dataStreamSettings so-metrics-vsphere_x_virtualmachine: *dataStreamSettings + so-metrics-system_x_core: *dataStreamSettings + so-metrics-system_x_cpu: *dataStreamSettings + so-metrics-system_x_diskio: *dataStreamSettings + so-metrics-system_x_filesystem: *dataStreamSettings + so-metrics-system_x_fsstat: *dataStreamSettings + so-metrics-system_x_load: *dataStreamSettings + so-metrics-system_x_memory: *dataStreamSettings + so-metrics-system_x_network: *dataStreamSettings + so-metrics-system_x_ntp: *dataStreamSettings + so-metrics-system_x_process: *dataStreamSettings + so-metrics-system_x_process_x_summary: *dataStreamSettings + so-metrics-system_x_socket_summary: *dataStreamSettings + so-metrics-system_x_uptime: *dataStreamSettings so-common: *dataStreamSettings so-endgame: *dataStreamSettings so-idh: *dataStreamSettings