Re: Elasticsearch 6.6.2 and non-standard index names
Simone Mainardi <[email protected]> Wed, 27 Mar 2019 10:47:20 +0100
| Newsgroups | gmane.linux.ntop.general |
|---|---|
| Message-ID | <[email protected]> |
--===============3217427609268462645== Content-Type: multipart/alternative; boundary="Apple-Mail=_6CDB58BA-72CD-4A9A-8569-04FCC02C6083" --Apple-Mail=_6CDB58BA-72CD-4A9A-8569-04FCC02C6083 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Correct. We didn't want the template to be possibly applied to all the ES indices = with potentially unpredictable behaviors, so we used the prefix ntopng- Simone > On 25 Mar 2019, at 20:29, Christina Phillips <[email protected]> = wrote: >=20 > Simone, true =E2=80=93 however the automatic push is only when the = index is named ntopng-* or a variant thereof.=20 > =20 > From: [email protected] = <[email protected]> On Behalf Of Simone Mainardi > Sent: Monday, March 25, 2019 1:01 PM > To: [email protected] > Subject: Re: [Ntop] Elasticsearch 6.6.2 and non-standard index names > =20 > The ntopng ES6 template is available at: = https://github.com/ntop/ntopng/blob/dev/httpdocs/misc/ntopng_template_elk6= .json = <https://github.com/ntop/ntopng/blob/dev/httpdocs/misc/ntopng_template_elk= 6.json> > =20 > ntopng automatically pushes it to ES when it detects it's version 6. > =20 > Simone >=20 >=20 > On 25 Mar 2019, at 17:18, Christina Phillips <[email protected] = <mailto:[email protected]>> wrote: > =20 > Hello. I have be previously able (Elasticsearch 5.6) to import the = ntopng-ES template into ES when the index name is not =E2=80=9Cntopng.=E2=80= =9D Since the template changed for ES 6 and above =E2=80=93 is there a = way to see the updated ntopng-ES template for ES6 so I can update my = indices to pick up the geoip and IP fields? Currently they are number = and string fields. > =20 > Thank you. > =20 > CHRISTINA PHILLIPS / Director, IT Security Practice > INDEPENDENT NETWORK CONSULTANTS > e: [email protected] <mailto:[email protected]> m: 703.626.0385 = <tel:703.626.0385> > http://incsecurity.wordpress.com <http://incsecurity.wordpress.com/> > Twitter: https://twitter.com/ITSecurityNinja = <https://twitter.com/ITSecurityNinja> > LinkedIn: www.linkedin.com/in/ChristinaPMBA = <http://www.linkedin.com/in/ChristinaPMBA> > =20 > =20 > _______________________________________________ > Ntop mailing list > [email protected] <mailto:[email protected]> > http://listgateway.unipi.it/mailman/listinfo/ntop = <http://listgateway.unipi.it/mailman/listinfo/ntop> > =20 > _______________________________________________ > Ntop mailing list > [email protected] > http://listgateway.unipi.it/mailman/listinfo/ntop --Apple-Mail=_6CDB58BA-72CD-4A9A-8569-04FCC02C6083 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 <html><head><meta http-equiv=3D"Content-Type" content=3D"text/html; = charset=3Dutf-8"></head><body style=3D"word-wrap: break-word; = -webkit-nbsp-mode: space; line-break: after-white-space;" = class=3D"">Correct.<div class=3D""><br class=3D""></div><div = class=3D""><br class=3D""></div><div class=3D"">We didn't want the = template to be possibly applied to all the ES indices with potentially = unpredictable behaviors, so we used the prefix ntopng-</div><div = class=3D""><br class=3D""></div><div class=3D""><br class=3D""></div><div = class=3D"">Simone<br class=3D""><div><br class=3D""><blockquote = type=3D"cite" class=3D""><div class=3D"">On 25 Mar 2019, at 20:29, = Christina Phillips <<a href=3D"mailto:[email protected]" = class=3D"">[email protected]</a>> wrote:</div><br = class=3D"Apple-interchange-newline"><div class=3D""><div = class=3D"WordSection1" style=3D"page: WordSection1; caret-color: rgb(0, = 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; = font-variant-caps: normal; font-weight: normal; letter-spacing: normal; = text-align: start; text-indent: 0px; text-transform: none; white-space: = normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; = text-decoration: none;"><div style=3D"margin: 0in 0in 0.0001pt; = font-size: 11pt; font-family: Calibri, sans-serif;" class=3D"">Simone, = true =E2=80=93 however the automatic push is only when the index is = named ntopng-* or a variant thereof. <o:p class=3D""></o:p></div><div= style=3D"margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: = Calibri, sans-serif;" class=3D""><o:p class=3D""> </o:p></div><div = class=3D""><div style=3D"border-style: solid none none; = border-top-width: 1pt; border-top-color: rgb(225, 225, 225); padding: = 3pt 0in 0in;" class=3D""><div style=3D"margin: 0in 0in 0.0001pt; = font-size: 11pt; font-family: Calibri, sans-serif;" class=3D""><b = class=3D"">From:</b><span class=3D"Apple-converted-space"> </span><a = href=3D"mailto:[email protected]" = class=3D"">[email protected]</a> <<a = href=3D"mailto:[email protected]" = class=3D"">[email protected]</a>><span = class=3D"Apple-converted-space"> </span><b class=3D"">On Behalf = Of<span class=3D"Apple-converted-space"> </span></b>Simone = Mainardi<br class=3D""><b class=3D"">Sent:</b><span = class=3D"Apple-converted-space"> </span>Monday, March 25, 2019 1:01 = PM<br class=3D""><b class=3D"">To:</b><span = class=3D"Apple-converted-space"> </span><a = href=3D"mailto:[email protected]" class=3D"">[email protected]</a><br = class=3D""><b class=3D"">Subject:</b><span = class=3D"Apple-converted-space"> </span>Re: [Ntop] Elasticsearch = 6.6.2 and non-standard index names<o:p = class=3D""></o:p></div></div></div><div style=3D"margin: 0in 0in = 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" = class=3D""><o:p class=3D""> </o:p></div><div style=3D"margin: 0in = 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" = class=3D"">The ntopng ES6 template is available at: <a = href=3D"https://github.com/ntop/ntopng/blob/dev/httpdocs/misc/ntopng_templ= ate_elk6.json" style=3D"color: purple; text-decoration: underline;" = class=3D"">https://github.com/ntop/ntopng/blob/dev/httpdocs/misc/ntopng_te= mplate_elk6.json</a><o:p class=3D""></o:p></div><div class=3D""><div = style=3D"margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: = Calibri, sans-serif;" class=3D""><o:p = class=3D""> </o:p></div></div><div class=3D""><div style=3D"margin: = 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" = class=3D"">ntopng automatically pushes it to ES when it detects it's = version 6.<o:p class=3D""></o:p></div></div><div class=3D""><div = style=3D"margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: = Calibri, sans-serif;" class=3D""><o:p = class=3D""> </o:p></div></div><div class=3D""><div style=3D"margin: = 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" = class=3D"">Simone<o:p class=3D""></o:p></div><div class=3D""><div = style=3D"margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: = Calibri, sans-serif;" class=3D""><br class=3D""><br class=3D""><o:p = class=3D""></o:p></div><blockquote style=3D"margin-top: 5pt; = margin-bottom: 5pt;" class=3D""><div class=3D""><div style=3D"margin: = 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" = class=3D"">On 25 Mar 2019, at 17:18, Christina Phillips <<a = href=3D"mailto:[email protected]" style=3D"color: purple; = text-decoration: underline;" class=3D"">[email protected]</a>> = wrote:<o:p class=3D""></o:p></div></div><div style=3D"margin: 0in 0in = 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" = class=3D""><o:p class=3D""> </o:p></div><div class=3D""><div = class=3D""><div style=3D"margin: 0in 0in 0.0001pt; font-size: 11pt; = font-family: Calibri, sans-serif;" class=3D"">Hello. I have be = previously able (Elasticsearch 5.6) to import the ntopng-ES template = into ES when the index name is not =E2=80=9Cntopng.=E2=80=9D Since = the template changed for ES 6 and above =E2=80=93 is there a way to see = the updated ntopng-ES template for ES6 so I can update my indices to = pick up the geoip and IP fields? Currently they are number and = string fields.<o:p class=3D""></o:p></div></div><div class=3D""><div = style=3D"margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: = Calibri, sans-serif;" class=3D""> <o:p = class=3D""></o:p></div></div><div class=3D""><div style=3D"margin: 0in = 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" = class=3D"">Thank you.<o:p class=3D""></o:p></div></div><div = class=3D""><div style=3D"margin: 0in 0in 0.0001pt; font-size: 11pt; = font-family: Calibri, sans-serif;" class=3D""> <o:p = class=3D""></o:p></div></div><div class=3D""><div style=3D"margin: 0in = 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" = class=3D""><b class=3D""><span style=3D"font-size: 8.5pt; font-family: = "Trebuchet MS", sans-serif; color: rgb(0, 112, 192); = text-transform: uppercase; letter-spacing: 1.5pt;" class=3D"">CHRISTINA = PHILLIPS</span></b><span style=3D"font-size: 8.5pt; font-family: = "Trebuchet MS", sans-serif; color: rgb(0, 112, 192);" = class=3D""> </span><span style=3D"font-size: 8.5pt; font-family: = "Trebuchet MS", sans-serif; color: rgb(136, 136, 136);" = class=3D"">/ Director, IT Security Practice</span><o:p = class=3D""></o:p></div></div><div class=3D""><div style=3D"margin: 0in = 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" = class=3D""><b class=3D""><span style=3D"font-size: 8.5pt; font-family: = "Trebuchet MS", sans-serif; color: rgb(0, 112, 192); = text-transform: uppercase; letter-spacing: 1.5pt;" class=3D"">INDEPENDENT = NETWORK CONSULTANTS</span></b><span style=3D"font-size: 8.5pt; = font-family: "Trebuchet MS", sans-serif; color: rgb(136, 136, = 136);" class=3D""><br class=3D""><b class=3D"">e:</b></span><span = style=3D"font-size: 8.5pt; font-family: "Trebuchet MS", = sans-serif; color: rgb(178, 178, 178);" class=3D""> </span><span = style=3D"color: rgb(31, 73, 125);" class=3D""><a = href=3D"mailto:[email protected]" style=3D"color: purple; = text-decoration: underline;" class=3D""><span style=3D"font-size: 8.5pt; = font-family: "Trebuchet MS", sans-serif;" = class=3D"">[email protected]</span></a></span><span style=3D"font-size: = 8.5pt; font-family: "Trebuchet MS", sans-serif; color: = rgb(178, 178, 178);" class=3D""> </span><b class=3D""><span = style=3D"font-size: 8.5pt; font-family: "Trebuchet MS", = sans-serif; color: rgb(136, 136, 136);" class=3D"">m:</span></b><span = style=3D"font-size: 8.5pt; font-family: "Trebuchet MS", = sans-serif; color: rgb(178, 178, 178);" class=3D""> <a = href=3D"tel:703.626.0385" style=3D"color: purple; text-decoration: = underline;" class=3D""><span style=3D"color: rgb(149, 79, 114);" = class=3D"">703.626.0385</span></a></span><o:p = class=3D""></o:p></div></div><div class=3D""><div style=3D"margin: 0in = 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" = class=3D""><span style=3D"font-size: 8.5pt; font-family: "Trebuchet = MS", sans-serif; color: rgb(178, 178, 178);" class=3D""><a = href=3D"http://incsecurity.wordpress.com/" style=3D"color: purple; = text-decoration: underline;" = class=3D"">http://incsecurity.wordpress.com</a></span><o:p = class=3D""></o:p></div></div><div class=3D""><div style=3D"margin: 0in = 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" = class=3D""><span style=3D"font-size: 8.5pt; font-family: "Trebuchet = MS", sans-serif; color: rgb(178, 178, 178);" class=3D"">Twitter:<span= class=3D"apple-converted-space"> </span><a = href=3D"https://twitter.com/ITSecurityNinja" style=3D"color: purple; = text-decoration: underline;" = class=3D"">https://twitter.com/ITSecurityNinja</a></span><o:p = class=3D""></o:p></div></div><div class=3D""><div style=3D"margin: 0in = 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" = class=3D""><span style=3D"font-size: 8.5pt; font-family: "Trebuchet = MS", sans-serif; color: rgb(178, 178, 178);" = class=3D"">LinkedIn: <span = class=3D"apple-converted-space"> </span></span><span = style=3D"font-size: 8.5pt; font-family: "Trebuchet MS", = sans-serif;" class=3D""><a = href=3D"http://www.linkedin.com/in/ChristinaPMBA" style=3D"color: = purple; text-decoration: underline;" = class=3D"">www.linkedin.com/in/ChristinaPMBA</a></span><o:p = class=3D""></o:p></div></div><div class=3D""><div style=3D"margin: 0in = 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" = class=3D""><span style=3D"font-size: 8.5pt; font-family: "Trebuchet = MS", sans-serif; color: rgb(178, 178, 178);" = class=3D""> </span><o:p class=3D""></o:p></div></div><div = class=3D""><div style=3D"margin: 0in 0in 0.0001pt; font-size: 11pt; = font-family: Calibri, sans-serif;" class=3D""> <o:p = class=3D""></o:p></div></div><div style=3D"margin: 0in 0in 0.0001pt; = font-size: 11pt; font-family: Calibri, sans-serif;" class=3D""><span = style=3D"font-size: 9pt; font-family: Helvetica, sans-serif;" = class=3D"">_______________________________________________<br = class=3D"">Ntop mailing list<br class=3D""></span><a = href=3D"mailto:[email protected]" style=3D"color: purple; = text-decoration: underline;" class=3D""><span style=3D"font-size: 9pt; = font-family: Helvetica, sans-serif; color: rgb(149, 79, 114);" = class=3D"">[email protected]</span></a><span style=3D"font-size: = 9pt; font-family: Helvetica, sans-serif;" class=3D""><br = class=3D""></span><a = href=3D"http://listgateway.unipi.it/mailman/listinfo/ntop" style=3D"color:= purple; text-decoration: underline;" class=3D""><span style=3D"font-size:= 9pt; font-family: Helvetica, sans-serif; color: rgb(149, 79, 114);" = class=3D"">http://listgateway.unipi.it/mailman/listinfo/ntop</span></a><o:= p class=3D""></o:p></div></div></blockquote></div><div style=3D"margin: = 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" = class=3D""><o:p class=3D""> </o:p></div></div></div><span = style=3D"caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: = 12px; font-style: normal; font-variant-caps: normal; font-weight: = normal; letter-spacing: normal; text-align: start; text-indent: 0px; = text-transform: none; white-space: normal; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none; float: none; = display: inline !important;" = class=3D"">_______________________________________________</span><br = style=3D"caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: = 12px; font-style: normal; font-variant-caps: normal; font-weight: = normal; letter-spacing: normal; text-align: start; text-indent: 0px; = text-transform: none; white-space: normal; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none;" class=3D""><span = style=3D"caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: = 12px; font-style: normal; font-variant-caps: normal; font-weight: = normal; letter-spacing: normal; text-align: start; text-indent: 0px; = text-transform: none; white-space: normal; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none; float: none; = display: inline !important;" class=3D"">Ntop mailing list</span><br = style=3D"caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: = 12px; font-style: normal; font-variant-caps: normal; font-weight: = normal; letter-spacing: normal; text-align: start; text-indent: 0px; = text-transform: none; white-space: normal; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none;" class=3D""><span = style=3D"caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: = 12px; font-style: normal; font-variant-caps: normal; font-weight: = normal; letter-spacing: normal; text-align: start; text-indent: 0px; = text-transform: none; white-space: normal; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none; float: none; = display: inline !important;" class=3D""><a = href=3D"mailto:[email protected]" = class=3D"">[email protected]</a></span><br style=3D"caret-color: = rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: = normal; font-variant-caps: normal; font-weight: normal; letter-spacing: = normal; text-align: start; text-indent: 0px; text-transform: none; = white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; = text-decoration: none;" class=3D""><span style=3D"caret-color: rgb(0, 0, = 0); font-family: Helvetica; font-size: 12px; font-style: normal; = font-variant-caps: normal; font-weight: normal; letter-spacing: normal; = text-align: start; text-indent: 0px; text-transform: none; white-space: = normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; = text-decoration: none; float: none; display: inline !important;" = class=3D""><a href=3D"http://listgateway.unipi.it/mailman/listinfo/ntop" = class=3D"">http://listgateway.unipi.it/mailman/listinfo/ntop</a></span></d= iv></blockquote></div><br class=3D""></div></body></html>= --Apple-Mail=_6CDB58BA-72CD-4A9A-8569-04FCC02C6083-- --===============3217427609268462645== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop --===============3217427609268462645==--