mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2025-12-15 05:32:49 +01:00
41 lines
1.0 KiB
YAML
41 lines
1.0 KiB
YAML
{% if grains['role'] == 'so-node' %}
|
|
|
|
{%- set cur_close_days = salt['pillar.get']('node:cur_close_days', '') -%}
|
|
|
|
{% elif grains['role'] == 'so-eval' %}
|
|
|
|
{%- set cur_close_days = salt['pillar.get']('master:cur_close_days', '') -%}
|
|
|
|
{%- endif %}
|
|
|
|
---
|
|
# Remember, leave a key empty if there is no value. None will be a string,
|
|
# not a Python "NoneType"
|
|
#
|
|
# Also remember that all examples have 'disable_action' set to True. If you
|
|
# want to use this action as a template, be sure to set this to False after
|
|
# copying it.
|
|
actions:
|
|
1:
|
|
action: close
|
|
description: >-
|
|
Close indices older than {{cur_close_days}} days (based on index name), for logstash-
|
|
prefixed indices.
|
|
options:
|
|
delete_aliases: False
|
|
timeout_override:
|
|
continue_if_exception: False
|
|
disable_action: False
|
|
filters:
|
|
- filtertype: pattern
|
|
kind: prefix
|
|
value: logstash-
|
|
exclude:
|
|
- filtertype: age
|
|
source: name
|
|
direction: older
|
|
timestring: '%Y.%m.%d'
|
|
unit: days
|
|
unit_count: {{cur_close_days}}
|
|
exclude:
|