Skip to content
This repository was archived by the owner on Jan 10, 2025. It is now read-only.

Commit f06078e

Browse files
DanRoscignoDanRoscigno
authored
update watcher examples for 7.x (#333)
* added remote cluster support (add endpoint arg) * fixed deprecation issues
1 parent 2ac7f59 commit f06078e

File tree

26 files changed

+70
-95
lines changed

26 files changed

+70
-95
lines changed

‎Alerting/Sample Watches/README.md‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -24,11 +24,11 @@ In each watch directory the following is provided:
2424

2525
The parent directory includes the following utility scripts:
2626

27-
* run_test.py - A python script which can be used to run a specific test e.g. python run_test.py --test_file new_process_started/tests/test1.json. Include optional username and password with --user and --password parameters.
27+
* run_test.py - A python script which can be used to run a specific test e.g. python run_test.py --test_file new_process_started/tests/test1.json. Include optional username and password with --user, --password, --endpoint, --port, and --protocol parameters.
2828
* load_watch.sh. Utility script for loading a watch to a local Elasticsearch cluster. Each watch can be loaded by running `load_watch.sh <watch folder name>`. This will also index any scripts. Username and password for the cluster can be specified as parameters e.g.
29-
`load_watch.sh <watch folder name> <username> <password> <protocol>`
30-
* run_test.sh - Runs a specified watches tests. Specify watch by directory name e.g. `run_test.sh port_scan`. Include optional username and password e.g. `run_test.sh port_scan <username> <password> <protocol>`.
31-
* run_all_tests.sh - Runs all tests. Include optional username and password e.g. `run_all_tests.sh <username> <password> <protocol>`.
29+
`load_watch.sh <watch folder name> <optional_username> <optional_password> <optional_endpoint>:<optional_port> <optional_protocol>"`
30+
* run_test.sh - Runs a specified watches tests. Specify watch by directory name e.g. `run_test.sh port_scan`. Include optional username and password e.g. `run_test.sh <watch folder name> <username> <password> <endpoint> <protocol>`.
31+
* run_all_tests.sh - Runs all tests. Include optional username and password e.g. `run_all_tests.sh <username> <password> <endpoint> <protocol>`.
3232

3333
If username, password, and protocol are not specified, the above scripts assume the x-pack default of "elastic", "changeme", and "http" respectively.
3434

‎Alerting/Sample Watches/cpu_iowait_hosts/mapping.json‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,5 @@
11
{
22
"mappings": {
3-
"doc":{
43
"properties": {
54
"beat":{
65
"properties": {
@@ -106,6 +105,5 @@
106105
}
107106
}
108107
}
109-
}
110108
}
111-
}
109+
}

‎Alerting/Sample Watches/cpu_iowait_hosts/watch.json‎

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -16,9 +16,6 @@
1616
"indices": [
1717
"metricbeat-*"
1818
],
19-
"types": [
20-
"doc"
21-
],
2219
"body": {
2320
"size": 0,
2421
"aggs": {
@@ -27,7 +24,7 @@
2724
"per_minute": {
2825
"date_histogram": {
2926
"field": "@timestamp",
30-
"interval": "{{ctx.metadata.interval}}"
27+
"fixed_interval": "{{ctx.metadata.interval}}"
3128
},
3229
"aggs": {
3330
"iowait": {
@@ -84,4 +81,4 @@
8481
}
8582
}
8683
}
87-
}
84+
}

‎Alerting/Sample Watches/errors_in_logs/mapping.json‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,5 @@
11
{
22
"mappings": {
3-
"doc": {
43
"properties": {
54
"@timestamp": {
65
"type": "date",
@@ -13,6 +12,5 @@
1312
"type": "keyword"
1413
}
1514
}
16-
}
1715
}
18-
}
16+
}

‎Alerting/Sample Watches/filesystem_usage/mapping.json‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,5 @@
11
{
22
"mappings": {
3-
"filesystem":{
43
"properties": {
54
"hostname":{
65
"type": "keyword"
@@ -12,6 +11,5 @@
1211
"type":"date"
1312
}
1413
}
15-
}
1614
}
17-
}
15+
}

‎Alerting/Sample Watches/filesystem_usage/watch.json‎

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -14,9 +14,6 @@
1414
"indices": [
1515
"logs"
1616
],
17-
"types": [
18-
"filesystem"
19-
],
2017
"body": {
2118
"aggs": {
2219
"host": {
@@ -75,9 +72,9 @@
7572
"log": {
7673
"logging": {
7774
"text": {
78-
"inline": "Some hosts are over {{ctx.payload.threshold}}% utilized:{{#ctx.payload.hosts}}{{disk_usage}}%-{{key}}:{{/ctx.payload.hosts}}"
75+
"source": "Some hosts are over {{ctx.payload.threshold}}% utilized:{{#ctx.payload.hosts}}{{disk_usage}}%-{{key}}:{{/ctx.payload.hosts}}"
7976
}
8077
}
8178
}
8279
}
83-
}
80+
}

‎Alerting/Sample Watches/lateral_movement_in_user_comm/mapping.json‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,5 @@
11
{
22
"mappings": {
3-
"doc": {
43
"properties": {
54
"user_server": {
65
"type": "keyword"
@@ -14,6 +13,5 @@
1413
"format": "HH:mm:ss||strict_time_no_millis"
1514
}
1615
}
17-
}
1816
}
19-
}
17+
}

‎Alerting/Sample Watches/load_watch.sh‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -60,14 +60,15 @@ do
6060
fi
6161
done
6262

63-
echo "Loading $1 watch "
6463

65-
curl -H "Content-Type: application/json" -s -o /dev/null -X DELETE $endpoint:$port/_xpack/watcher/watch/$1 -u $username:$password
64+
echo "Removing existing $1 watch "
65+
curl -H "Content-Type: application/json" -s -X DELETE $protocol$endpoint:$port/_xpack/watcher/watch/$1 -u $username:$password
66+
echo "Loading $1 watch "
6667
es_response=$(curl -H "Content-Type: application/json" --w "%{http_code}" -s -o /dev/null -X PUT $protocol$endpoint:$port/_xpack/watcher/watch/$1 -u $username:$password -d @$1/watch.json)
6768
if [ 0 -eq $? ] && [ $es_response = "201" ]; then
68-
echo "Loading $2 watch...OK"
69+
echo "Loading $1 watch...OK"
6970
exit 0
7071
else
71-
echo "Loading $2 watch...FAILED"
72+
echo "Loading $1 watch...FAILED with response code $es_response"
7273
exit 1
7374
fi

‎Alerting/Sample Watches/monitoring_cluster_health/mapping.json‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,5 @@
11
{
22
"mappings": {
3-
"doc": {
43
"date_detection": false,
54
"properties": {
65
"cluster_state": {
@@ -37,6 +36,5 @@
3736
"type": "keyword"
3837
}
3938
}
40-
}
4139
}
42-
}
40+
}

‎Alerting/Sample Watches/monitoring_cluster_health/tests/test1.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"watch_name":"monitoring_cluster_health",
33
"mapping_file":"./monitoring_cluster_health/mapping.json",
4-
"index":".monitoring-es-test",
4+
"index":"monitoring-es-test",
55
"type":"doc",
66
"time_field":"timestamp",
77
"watch_file":"./monitoring_cluster_health/watch.json",

0 commit comments

Comments
 (0)