CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2026-05-05 02:48:21 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fix import and syslog actions

Browse Source
This commit is contained in:
Wes
2023-03-07 17:41:48 +00:00
parent 26c9813276
commit f50639d2d2
2 changed files with 6 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
salt/curator/files/action/logs-import-so-delete.yml
+3 -3
View File
@@ -3,19 +3,19 @@
# https://securityonion.net/license; you may not use this file except in compliance with the # https://securityonion.net/license; you may not use this file except in compliance with the
# Elastic License 2.0. # Elastic License 2.0.
{%- set DELETE_DAYS = CURATORMERGED['logs-syslog-so'].delete %} {%- set DELETE_DAYS = CURATORMERGED['logs-import-so'].delete %}
actions: actions:
1: 1:
action: delete_indices action: delete_indices
description: >- description: >-
Delete syslog indices when older than {{ DELETE_DAYS }} days. Delete import indices when older than {{ DELETE_DAYS }} days.
options: options:
ignore_empty_list: True ignore_empty_list: True
disable_action: False disable_action: False
filters: filters:
- filtertype: pattern - filtertype: pattern
kind: regex kind: regex
value: '^(.ds-logs-syslog-so.*)$' value: '^(.ds-logs-import-so.*)$'
- filtertype: age - filtertype: age
source: name source: name
direction: older direction: older
salt/curator/files/action/logs-syslog-so-delete.yml
+3 -3
View File
@@ -3,19 +3,19 @@
# https://securityonion.net/license; you may not use this file except in compliance with the # https://securityonion.net/license; you may not use this file except in compliance with the
# Elastic License 2.0. # Elastic License 2.0.
{%- set DELETE_DAYS = CURATORMERGED['logs-import-so'].delete %} {%- set DELETE_DAYS = CURATORMERGED['logs-syslog-so'].delete %}
actions: actions:
1: 1:
action: delete_indices action: delete_indices
description: >- description: >-
Delete import indices when older than {{ DELETE_DAYS }} days. Delete syslog indices when older than {{ DELETE_DAYS }} days.
options: options:
ignore_empty_list: True ignore_empty_list: True
disable_action: False disable_action: False
filters: filters:
- filtertype: pattern - filtertype: pattern
kind: regex kind: regex
value: '^(.ds-logs-import-so.*)$' value: '^(.ds-logs-syslog-so.*)$'
- filtertype: age - filtertype: age
source: name source: name
direction: older direction: older