Skip to content

Update the deleted indexes in OVA and AMI builds #779

@CarlosALgit

Description

@CarlosALgit

Description

The aim of this issue is to add more indexes to their deletion process in the OVA and AMI builds.

At the moment, we are deleting only the wazuh-* indexes. This leaves some indexes not working as expected.
This behavior is reported in this comment: wazuh/wazuh-indexer#1591 (comment).

Implementation

The indexes to delete are the following:

curl -XDELETE "https://127.0.0.1:9200/wazuh-*"
curl -XDELETE "https://127.0.0.1:9200/_data_stream/*"
curl -XDELETE "https://127.0.0.1:9200/.wazuh-cti-consumers"
curl -XDELETE "https://127.0.0.1:9200/.wazuh-threatintel-vulnerabilities-*"
curl -XDELETE "https://127.0.0.1:9200/.wazuh-settings"
curl -XDELETE "https://127.0.0.1:9200/.wazuh-content-manager-jobs"

We have to include this in the following code snippets:

OVA

run_command("curl -u admin:admin -XDELETE 'https://127.0.0.1:9200/wazuh-*' -k")

AMI

command = f'sudo curl -s -o /dev/null -w "%{{http_code}}" -X DELETE -u "admin:admin" -k "{base_url}/wazuh-*"'

Tasks

  • Add the code necessary to delete all the mentioned indexes.
  • Test the AMI and OVA build.
  • Check that the wazuh-threatintel-enrichments index is populated in OVA and AMI.

Metadata

Metadata

Assignees

Labels

Type

No type
No fields configured for issues without a type.

Projects

Status

In progress

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions