mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2026-01-02 14:23:14 +01:00
29 lines
963 B
YAML
29 lines
963 B
YAML
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
|
|
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
|
|
# https://securityonion.net/license; you may not use this file except in compliance with the
|
|
# Elastic License 2.0.
|
|
|
|
|
|
{%- set cur_close_days = salt['pillar.get']('elasticsearch:index_settings:so-google_workspace:close', 30) -%}
|
|
actions:
|
|
1:
|
|
action: close
|
|
description: >-
|
|
Close google_workspace indices older than {{cur_close_days}} days.
|
|
options:
|
|
delete_aliases: False
|
|
timeout_override:
|
|
continue_if_exception: False
|
|
disable_action: False
|
|
filters:
|
|
- filtertype: pattern
|
|
kind: regex
|
|
value: '^(logstash-google_workspace.*|so-google_workspace.*)$'
|
|
- filtertype: age
|
|
source: name
|
|
direction: older
|
|
timestring: '%Y.%m.%d'
|
|
unit: days
|
|
unit_count: {{cur_close_days}}
|
|
exclude:
|