reyesj2
96fcc0ec38
wip
2026-06-22 14:25:46 -05:00
Josh Patterson
8e33d0e1e9
Merge remote-tracking branch 'origin/3/dev' into soupmod2
2026-06-16 12:54:18 -04:00
reyesj2
f68e3e47a1
remove pillar merge
2026-06-16 09:19:10 -05:00
reyesj2
d10f21399c
remove comments
2026-06-15 13:31:23 -05:00
Josh Patterson
6c42c419e2
Serialize ILM policy-load output with flock to stop interleaving
...
A single printf per block was not actually one write() call, so
concurrent jobs still occasionally interleaved their label and response
lines. Hold an flock around just the printf (curl still runs in
parallel) so each policy's block prints intact, keeping live
completion-order streaming.
2026-06-11 15:42:41 -04:00
Josh Patterson
07d3b148b5
fix output
2026-06-11 13:37:26 -04:00
Josh Patterson
780d9faf0d
Parallelize so-elasticsearch-ilm-policy-load PUTs
...
Run the ~300 ILM policy PUTs concurrently (bounded to 10 in flight via a
throttle gate) instead of one serial curl per policy. Adds a put_policy
helper and waits for all background jobs before exiting. Preserves policy
parity; only the scheduling changes. Drops the dead empty sid cookie arg
(falls back to basic auth from curl.config as before).
2026-06-11 12:08:32 -04:00
reyesj2
cf456dc58c
reuse existing index templates
2026-06-09 23:21:43 -05:00
reyesj2
9aa9ea3255
Iniitial DLM support
2026-06-09 23:19:26 -05:00
reyesj2
29e13b2c0b
elasticsearch ilm policy load script
2026-04-13 10:00:17 -05:00
reyesj2
6298397534
rework elasticsearch template load script -- for core templates
2026-04-11 04:40:47 -05:00
Josh Patterson
a192455fae
Merge remote-tracking branch 'origin/2.4/dev' into bravo
2026-01-19 17:17:58 -05:00
reyesj2
596bc178df
ensure docker cp command follows container symlinks
2026-01-15 15:18:18 -06:00
Josh Patterson
3bc552ef38
Merge remote-tracking branch 'origin/2.4/dev' into bravo
2026-01-08 17:15:48 -05:00
Josh Patterson
1887d2c0e9
update heavynode pattern
2026-01-08 17:15:00 -05:00
reyesj2
7977a020ac
elasticsearch 9.0.8
2025-12-16 16:03:47 -06:00
reyesj2
b9d813cef2
typo
2025-07-08 18:26:46 -05:00
reyesj2
d4f0cbcb67
changes for 'generic' integrations with no compoent templates assigned. Default to using the logs-filestream.generic@package componet template
2025-07-08 15:23:46 -05:00
weslambert and GitHub
aacd715379
Retry after 1 second
2024-09-25 13:07:01 -04:00
weslambert and GitHub
50ae37c160
Check if running during soup
2024-09-25 08:25:20 -04:00
m0duspwnens
df14cbad44
fix calls to get_elastic_agent_vars
2024-09-04 17:43:49 -04:00
weslambert and GitHub
dd09f5b153
Add so-soc-logs
2024-08-26 10:32:27 -04:00
weslambert and GitHub
d7e3e134a5
Check Elasticsearch for template
2024-08-22 10:33:13 -04:00
weslambert and GitHub
2a024039bf
Merge pull request #13528 from Security-Onion-Solutions/fix/detections_alerts_ilm
...
Create detections.alerts ILM policy with corresponding name
2024-08-21 14:50:10 -04:00
weslambert and GitHub
88ea60df2a
Fix name
2024-08-21 14:38:57 -04:00
weslambert and GitHub
c1b7232a88
Fix for detections-alerts
2024-08-21 14:38:29 -04:00
weslambert and GitHub
4108e67178
Check for endpoint package
2024-08-21 14:22:28 -04:00
weslambert and GitHub
5f74b1b730
Update column number because of changes to API
2024-08-15 08:26:56 -04:00
Doug Burks and GitHub
ab63d5dbdb
Update so-elasticsearch-cluster-space-used for changes in _cat/allocation API
2024-08-15 08:01:22 -04:00
weslambert and GitHub
d833bd0d55
Elastic 8.14.3
2024-07-30 12:45:25 -04:00
weslambert and GitHub
fe1824aedd
Revert "Elastic 8.14.2"
2024-07-15 11:28:59 -04:00
weslambert and GitHub
0db0754ee5
Merge pull request #13316 from Security-Onion-Solutions/foxtrot
...
Elastic 8.14.2
2024-07-10 08:53:03 -04:00
Wes
1b47d5c622
Changes for Elastic 8.14.1
2024-07-01 15:16:58 +00:00
m0duspwnens
81fcd68e9b
create and use redis:nodes and elasticsearch:nodes pillars
2024-06-20 16:42:11 -04:00
weslambert and GitHub
deb140e38e
Exclude detections from template name matching
2024-05-21 13:38:52 -04:00
weslambert and GitHub
b424426298
Exclude suricata
2024-04-25 09:14:18 -04:00
weslambert and GitHub
44afa55274
Fix comments about deletion
2024-04-24 17:41:37 -04:00
weslambert and GitHub
ab832e4bb2
Include logstash-prefixed indices
2024-04-24 17:17:53 -04:00
weslambert and GitHub
59a02635ed
Change index sorting
2024-04-24 15:18:49 -04:00
Doug Burks and GitHub
406dda6051
Update so-elasticsearch-cluster-space-used
2024-04-18 11:48:15 -04:00
Doug Burks and GitHub
229a989914
Update so-elasticsearch-cluster-space-total
2024-04-18 11:47:01 -04:00
Wes
4baf4657f6
Curator cleanup
2023-12-20 19:10:22 +00:00
Wes
54c3167b10
Delete data streams when necessary
2023-12-12 05:25:50 +00:00
Wes
d203aec44a
Remove Curator
2023-12-08 19:37:06 +00:00
weslambert and GitHub
02baa18502
Add metrics
2023-11-08 22:41:24 -05:00
weslambert and GitHub
e39edab00d
Exclude osquery and display failed name
2023-11-08 20:55:08 -05:00
weslambert and GitHub
acb6e84248
Don't load index template if component template doesn't exist
2023-11-08 20:34:08 -05:00
Jason Ertel
d256be3eb3
allow template loads to partially succeed only on the initial attempt
2023-11-08 10:32:11 -05:00
Wes
653fda124f
Check expected with retry
2023-11-08 13:02:17 +00:00
Wes
b46e86c39b
Extend index template loading to 60 attempts and a total of ~5 minutes
2023-11-08 02:29:09 +00:00
reyesj2
Josh Patterson
weslambertandGitHub
Doug BurksandGitHub
Jason Ertel