search

falcosecurity / falcosidekick

Connect Falco to your ecosystem
Apache License 2.0
538 stars 173 forks source link

Include dateformat suffix to Elasticsearch indices #27

Closed ariguillegp closed 5 years ago

ariguillegp commented 5 years ago

It is really helpful to have indices that can group data on a daily, monthly or annually basis. Here we have some examples: Daily index: sample-2019.06.24 Monthly index: sample-2019.06 Annual index: sample-2019

Issif commented 5 years ago

Hi,

Thanks for your issue, I agree you, I already had that in mind and got several ideas for implement it.

Will do it asap.

Issif commented 5 years ago

@ariguillegp I just pushed a new branch https://github.com/Issif/falcosidekick/tree/suffix_elasticsearch

Please test docker image with tag suffix_elasticsearch, details are in README of branch.

For now, it's UTC only, do you need timezoning for rotations?

ariguillegp commented 5 years ago

Thanks, I just tested the image and the only problem I found was with the monthly indices. That's why I am proposing https://github.com/Issif/falcosidekick/pull/28

Issif commented 5 years ago

I rebased with your commit, thanks. If ok for you, I'm releasing a new version.

ariguillegp commented 5 years ago

Tested again and it works fine! Thanks