Skip to content

Commit 0369a4e

Browse files
AlexRuiz7AlexRuiz7
committed
Update ISM init script (#50)
1 parent 91a2de0 commit 0369a4e

File tree

1 file changed

+192
-106
lines changed

1 file changed

+192
-106
lines changed

‎scripts/indexer-ism-init.sh

+192-106
Original file line numberDiff line numberDiff line change
@@ -3,18 +3,20 @@
33
# Wazuh - Indexer set rollover policy and templates
44

55
# Policy settings
6-
MIN_SHARD_SIZE=${MIN_SHARD_SIZE:-25}
7-
MIN_INDEX_AGE=${MIN_INDEX_AGE:-"7d"}
8-
MIN_DOC_COUNT=${MIN_DOC_COUNT:-200000000}
9-
ISM_INDEX_PATTERNS=${ISM_INDEX_PATTERNS:-'["wazuh-alerts-*", "wazuh-archives-*", "-wazuh-alerts-4.x-sample*"]'}
10-
ISM_PRIORITY=${ISM_PRIORITY:-50}
6+
MIN_SHARD_SIZE="25"
7+
MIN_INDEX_AGE="7d"
8+
MIN_DOC_COUNT="200000000"
9+
ISM_INDEX_PATTERNS='["wazuh-alerts-*", "wazuh-archives-*", "-wazuh-alerts-4.x-sample*"]'
10+
ISM_PRIORITY="50"
11+
INDEXER_PASSWORD="admin"
12+
INDEXER_HOSTNAME="localhost"
1113

1214
POLICY_NAME="rollover_policy"
1315

14-
INDEXER_URL="https://localhost:9200"
16+
INDEXER_URL="https://${INDEXER_HOSTNAME}:9200"
1517

1618
# curl settings shortcuts
17-
C_AUTH="-u admin:admin"
19+
C_AUTH="-u admin:${INDEXER_PASSWORD}"
1820

1921
#########################################################################
2022
# Creates the rollover_policy ISM policy.
@@ -30,35 +32,34 @@ C_AUTH="-u admin:admin"
3032
# The rollover policy as a JSON string
3133
#########################################################################
3234
function generate_rollover_policy() {
33-
cat <<EOF
34-
{
35-
"policy": {
36-
"description": "Wazuh rollover and alias policy",
37-
"default_state": "active",
38-
"states": [
35+
cat <<-EOF
3936
{
40-
"name": "active",
41-
"actions": [
42-
{
43-
"rollover": {
44-
"min_primary_shard_size": "${MIN_SHARD_SIZE}gb",
45-
"min_index_age": "${MIN_INDEX_AGE}",
46-
"min_doc_count": "${MIN_DOC_COUNT}"
47-
}
37+
"policy": {
38+
"description": "Wazuh rollover and alias policy",
39+
"default_state": "active",
40+
"states": [
41+
{
42+
"name": "active",
43+
"actions": [
44+
{
45+
"rollover": {
46+
"min_primary_shard_size": "${MIN_SHARD_SIZE}gb",
47+
"min_index_age": "${MIN_INDEX_AGE}",
48+
"min_doc_count": "${MIN_DOC_COUNT}"
49+
}
50+
}
51+
]
52+
}
53+
],
54+
"ism_template": {
55+
"index_patterns": ${ISM_INDEX_PATTERNS},
56+
"priority": "${ISM_PRIORITY}"
57+
}
4858
}
49-
]
5059
}
51-
],
52-
"ism_template": {
53-
"index_patterns": $ISM_INDEX_PATTERNS,
54-
"priority": "${ISM_PRIORITY}"
55-
}
56-
}
57-
}
58-
EOF
60+
EOF
5961
}
6062

61-
6263
#########################################################################
6364
# Creates an index template with order 3 to set the rollover alias.
6465
# Arguments:
@@ -67,32 +68,30 @@ EOF
6768
# The index template as a JSON string.
6869
#########################################################################
6970
function generate_rollover_template() {
70-
cat <<EOF
71-
{
72-
"order": 3,
73-
"index_patterns": ["$1-*"],
74-
"settings": {
75-
"index.plugins.index_state_management.rollover_alias": "$1"
76-
}
77-
}
78-
EOF
71+
cat <<-EOF
72+
{
73+
"order": 3,
74+
"index_patterns": ["${1}-*"],
75+
"settings": {
76+
"index.plugins.index_state_management.rollover_alias": "${1}"
77+
}
78+
}
79+
EOF
7980
}
8081

81-
8282
#########################################################################
8383
# Loads the index templates for the rollover policy to the indexer.
8484
#########################################################################
8585
function load_templates() {
86-
# Note: the wazuh-template.json could also be loaded here.
87-
for alias in "${aliases[@]}"; do
88-
echo "TEMPLATES AND POLICIES - Uploading ${alias} template"
89-
generate_rollover_template "${alias}" | curl -s -k ${C_AUTH} \
90-
-X PUT "$INDEXER_URL/_template/${alias}-rollover" -o /dev/null \
91-
-H 'Content-Type: application/json' -d @-
92-
done
86+
# Note: the wazuh-template.json could also be loaded here.
87+
for alias in "${aliases[@]}"; do
88+
echo "TEMPLATES AND POLICIES - Uploading ${alias} template"
89+
generate_rollover_template "${alias}" | curl -s -k ${C_AUTH} \
90+
-X PUT "${INDEXER_URL}/_template/${alias}-rollover" -o /dev/null \
91+
-H 'Content-Type: application/json' -d @-
92+
done
9393
}
9494

95-
9695
#########################################################################
9796
# Uploads the rollover policy.
9897
# If the policy does not exist, the policy "${POLICY_NAME}" is created.
@@ -102,107 +101,194 @@ function load_templates() {
102101
# None.
103102
#########################################################################
104103
function upload_rollover_policy() {
105-
policy_exists=$(
106-
curl -s -k ${C_AUTH} \
107-
-X GET "$INDEXER_URL/_plugins/_ism/policies/${POLICY_NAME}" \
108-
-o /dev/null \
109-
-w "%{http_code}"
110-
)
111-
112-
# Check if the ${POLICY_NAME} ISM policy was loaded (404 error if not found)
113-
if [[ $policy_exists == "404" ]]; then
114-
echo "TEMPLATES AND POLICIES - Uploading ${POLICY_NAME} ISM policy"
115-
generate_rollover_policy | curl -s -k ${C_AUTH} -o /dev/null \
116-
-X PUT "$INDEXER_URL/_plugins/_ism/policies/${POLICY_NAME}" \
117-
-H 'Content-Type: application/json' -d @-
118-
else
119-
if [[ $policy_exists == "200" ]]; then
120-
echo "TEMPLATES AND POLICIES - ${POLICY_NAME} policy already exists"
104+
policy_exists=$(
105+
curl -s -k ${C_AUTH} \
106+
-X GET "${INDEXER_URL}/_plugins/_ism/policies/${POLICY_NAME}" \
107+
-o /dev/null \
108+
-w "%{http_code}"
109+
)
110+
111+
# Check if the ${POLICY_NAME} ISM policy was loaded (404 error if not found)
112+
if [[ "${policy_exists}" == "404" ]]; then
113+
echo "TEMPLATES AND POLICIES - Uploading ${POLICY_NAME} ISM policy"
114+
curl -s -k ${C_AUTH} -o /dev/null \
115+
-X PUT "${INDEXER_URL}/_plugins/_ism/policies/${POLICY_NAME}" \
116+
-H 'Content-Type: application/json' -d "$(generate_rollover_policy)"
121117
else
122-
echo "TEMPLATES AND POLICIES - Error uploading ${POLICY_NAME} policy"
118+
if [[ "${policy_exists}" == "200" ]]; then
119+
echo "TEMPLATES AND POLICIES - ${POLICY_NAME} policy already exists"
120+
else
121+
echo "TEMPLATES AND POLICIES - Error uploading ${POLICY_NAME} policy"
122+
fi
123123
fi
124-
fi
125124
}
126125

127-
128126
#########################################################################
129127
# Check if an alias exists in the indexer.
130128
# Arguments:
131129
# 1. The alias to look for. String.
132130
#########################################################################
133131
function check_for_write_index() {
134-
curl -s -k ${C_AUTH} "$INDEXER_URL/_cat/aliases" | \
135-
grep -i "${1}" | \
136-
grep -i true | \
137-
awk '{print $2}'
132+
curl -s -k ${C_AUTH} "${INDEXER_URL}/_cat/aliases" |
133+
grep -i "${1}" |
134+
grep -i true |
135+
awk '{print $2}'
138136
}
139137

140-
141138
#########################################################################
142139
# Creates the settings for the aliased write index.
143140
# Arguments:
144141
# 1. The alias. String.
145142
#########################################################################
146143
function generate_write_index_alias() {
147-
cat << EOF
148-
{
149-
"aliases": {
150-
"$1": {
151-
"is_write_index": true
152-
}
144+
cat <<-EOF
145+
{
146+
"aliases": {
147+
"$1": {
148+
"is_write_index": true
149+
}
150+
}
153151
}
154-
}
155-
EOF
152+
EOF
156153
}
157154

158-
159155
#########################################################################
160156
# Creates the initial aliased write index.
161157
# Arguments:
162158
# 1. The alias. String.
163159
#########################################################################
164160
function create_write_index() {
165-
curl -s -k ${C_AUTH} -o /dev/null \
166-
-X PUT "$INDEXER_URL/%3C${1}-4.x-%7Bnow%2Fd%7D-000001%3E?pretty" \
167-
-H 'Content-Type: application/json' -d "$(generate_write_index_alias "${1}")"
161+
curl -s -k ${C_AUTH} -o /dev/null \
162+
-X PUT "$INDEXER_URL/%3C${1}-4.x-%7Bnow%2Fd%7D-000001%3E?pretty" \
163+
-H 'Content-Type: application/json' -d "$(generate_write_index_alias "${1}")"
168164
}
169165

170-
171166
#########################################################################
172167
# Creates the write indices for the aliases given as parameter.
173168
# Arguments:
174169
# 1. List of aliases to initialize.
175170
#########################################################################
176171
function create_indices() {
177-
echo "TEMPLATES AND POLICIES - Creating write indices"
178-
for alias in "${aliases[@]}"; do
179-
# Check if there are any write indices for the current alias
180-
write_index_exists=$(check_for_write_index "${alias}")
181-
182-
# Create the write index if it does not exist
183-
if [[ -z $write_index_exists ]]; then
184-
create_write_index "${alias}"
185-
fi
186-
done
172+
echo "TEMPLATES AND POLICIES - Creating write indices"
173+
for alias in "${aliases[@]}"; do
174+
# Check if there are any write indices for the current alias
175+
write_index_exists=$(check_for_write_index "${alias}")
176+
177+
# Create the write index if it does not exist
178+
if [[ -z $write_index_exists ]]; then
179+
create_write_index "${alias}"
180+
fi
181+
done
187182
}
188183

189184

185+
#########################################################################
186+
# Shows usage help.
187+
#########################################################################
188+
function show_help() {
189+
echo -e ""
190+
echo -e "NAME"
191+
echo -e " indexer-ism-init.sh - Manages the Index State Management plugin for Wazuh indexer index rollovers policies."
192+
echo -e ""
193+
echo -e "SYNOPSIS"
194+
echo -e " indexer-ism-init.sh [OPTIONS]"
195+
echo -e ""
196+
echo -e "DESCRIPTION"
197+
echo -e " -a, --min-index-age <index-age>"
198+
echo -e " Set the minimum index age. By default 7d."
199+
echo -e ""
200+
echo -e " -d, --min-doc-count <doc-count>"
201+
echo -e " Set the minimum document count. By default 200000000."
202+
echo -e ""
203+
echo -e " -h, --help"
204+
echo -e " Shows help."
205+
echo -e ""
206+
echo -e " -i, --indexer-hostname <hostname>"
207+
echo -e " Specifies the Wazuh indexer hostname or IP."
208+
echo -e ""
209+
echo -e " -p, --indexer-password <password>"
210+
echo -e " Specifies the Wazuh indexer admin user password."
211+
echo -e ""
212+
echo -e " -s, --min-shard-size <shard-size>"
213+
echo -e " Set the minimum shard size in GB. By default 25."
214+
echo -e ""
215+
exit 1
216+
}
217+
190218
#########################################################################
191219
# Main function.
192220
#########################################################################
193221
function main() {
194-
# The list should contain every alias which indices implement the
195-
# rollover policy
196-
aliases=("wazuh-alerts" "wazuh-archives")
222+
# The list should contain every alias which indices implement the
223+
# rollover policy
224+
aliases=("wazuh-alerts" "wazuh-archives")
225+
226+
while [ -n "${1}" ]; do
227+
case "${1}" in
228+
"-a" | "--min-index-age")
229+
if [ -z "${2}" ]; then
230+
echo "Error on arguments. Probably missing <index-age> after -a|--min-index-age"
231+
show_help
232+
else
233+
MIN_INDEX_AGE="${2}"
234+
shift 2
235+
fi
236+
;;
237+
"-d" | "--min-doc-count")
238+
if [ -z "${2}" ]; then
239+
echo "Error on arguments. Probably missing <doc-count> after -d|--min-doc-count"
240+
show_help
241+
else
242+
MIN_DOC_COUNT="${2}"
243+
shift 2
244+
fi
245+
;;
246+
"-h" | "--help")
247+
show_help
248+
;;
249+
"-i" | "--indexer-hostname")
250+
if [ -z "${2}" ]; then
251+
echo "Error on arguments. Probably missing <hostname> after -i|--indexer-hostname"
252+
show_help
253+
else
254+
INDEXER_HOSTNAME="${2}"
255+
shift 2
256+
fi
257+
;;
258+
"-p" | "--indexer-password")
259+
if [ -z "${2}" ]; then
260+
echo "Error on arguments. Probably missing <password> after -p|--indexer-password"
261+
show_help
262+
else
263+
INDEXER_PASSWORD="${2}"
264+
C_AUTH="-u admin:${INDEXER_PASSWORD}"
265+
shift 2
266+
fi
267+
;;
268+
"-s" | "--min-shard-size")
269+
if [ -z "${2}" ]; then
270+
echo "Error on arguments. Probably missing <shard-size> after -s|--min-shard-size"
271+
show_help
272+
else
273+
MIN_SHARD_SIZE="${2}"
274+
shift 2
275+
fi
276+
;;
277+
*)
278+
echo "Unknow option: ${1}"
279+
show_help
280+
;;
281+
esac
282+
done
197283

198-
# Load the Wazuh Indexer templates
199-
load_templates
284+
# Load the Wazuh Indexer templates
285+
load_templates
200286

201-
# Upload the rollover policy
202-
upload_rollover_policy
287+
# Upload the rollover policy
288+
upload_rollover_policy
203289

204-
# Create the initial write indices
205-
create_indices "${aliases[@]}"
290+
# Create the initial write indices
291+
create_indices "${aliases[@]}"
206292
}
207293

208-
main "$@"
294+
main "$@"

0 commit comments

Comments
 (0)