Skip to content

Commit 8dd1c9f

Browse files
petardzpetardz
authored
fixed GetFindings not searching all indices; fixed proper deletion of… (opensearch-project#122)
* fixed GetFindings not searching all indices; fixed proper deletion of old history indices Signed-off-by: Petar Dzepina <petar.dzepina@gmail.com>
1 parent 1b36aa1 commit 8dd1c9f

7 files changed

Lines changed: 327 additions & 34 deletions

File tree

‎src/main/java/org/opensearch/securityanalytics/alerts/AlertsService.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -82,7 +82,7 @@ public void onResponse(GetDetectorResponse getDetectorResponse) {
8282
AlertsService.this.getAlertsByMonitorIds(
8383
monitorToDetectorMapping,
8484
monitorIds,
85-
DetectorMonitorConfig.getAlertsIndex(detector.getDetectorType()),
85+
DetectorMonitorConfig.getAllAlertsIndicesPattern(detector.getDetectorType()),
8686
table,
8787
severityLevel,
8888
alertState,
@@ -193,7 +193,7 @@ public void getAlerts(
193193
AlertsService.this.getAlertsByMonitorIds(
194194
monitorToDetectorMapping,
195195
allMonitorIds,
196-
DetectorMonitorConfig.getAlertsIndex(detectorType.getDetectorType()),
196+
DetectorMonitorConfig.getAllAlertsIndicesPattern(detectorType.getDetectorType()),
197197
table,
198198
severityLevel,
199199
alertState,

‎src/main/java/org/opensearch/securityanalytics/config/monitors/DetectorMonitorConfig.java‎

Lines changed: 38 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,8 @@
44
*/
55
package org.opensearch.securityanalytics.config.monitors;
66

7-
import java.util.ArrayList;
87
import java.util.List;
8+
import java.util.stream.Collectors;
99
import org.opensearch.securityanalytics.model.Detector;
1010

1111
import java.util.Arrays;
@@ -18,9 +18,11 @@ public class DetectorMonitorConfig {
1818

1919
public static final String OPENSEARCH_DEFAULT_RULE_INDEX = ".opensearch-sap-detectors-queries-default";
2020
public static final String OPENSEARCH_DEFAULT_ALERT_INDEX = ".opensearch-sap-alerts-default";
21+
public static final String OPENSEARCH_DEFAULT_ALL_ALERT_INDICES_PATTERN = ".opensearch-sap-alerts-default*";
2122
public static final String OPENSEARCH_DEFAULT_ALERT_HISTORY_INDEX = ".opensearch-sap-alerts-history-default";
2223
public static final String OPENSEARCH_DEFAULT_ALERT_HISTORY_INDEX_PATTERN = "<.opensearch-sap-alerts-history-default-{now/d}-1>";
2324
public static final String OPENSEARCH_DEFAULT_FINDINGS_INDEX = ".opensearch-sap-findings-default";
25+
public static final String OPENSEARCH_DEFAULT_ALL_FINDINGS_INDICES_PATTERN = ".opensearch-sap-findings-default*";
2426
public static final String OPENSEARCH_DEFAULT_FINDINGS_INDEX_PATTERN = "<.opensearch-sap-findings-default-{now/d}-1>";
2527

2628
private static Map<String, MonitorConfig> detectorTypeToIndicesMapping;
@@ -41,10 +43,16 @@ public class DetectorMonitorConfig {
4143
Locale.getDefault(), ".opensearch-sap-%s-alerts*", detectorType.getDetectorType());
4244
String findingsIndex = String.format(
4345
Locale.getDefault(), ".opensearch-sap-%s-findings", detectorType.getDetectorType());
46+
String allFindingsIndicesPattern = String.format(
47+
Locale.getDefault(), ".opensearch-sap-%s-findings*", detectorType.getDetectorType());
4448
String findingsIndexPattern = String.format(
4549
Locale.getDefault(), "<.opensearch-sap-%s-findings-{now/d}-1>", detectorType.getDetectorType());
4650

47-
MonitorConfig monitor = new MonitorConfig(alertsIndex, alertsHistoryIndex, alertsHistoryIndexPattern, allAlertsIndicesPattern, findingsIndex, findingsIndexPattern, ruleIndex);
51+
MonitorConfig monitor = new MonitorConfig(
52+
alertsIndex, alertsHistoryIndex, alertsHistoryIndexPattern, allAlertsIndicesPattern,
53+
findingsIndex, findingsIndexPattern, allFindingsIndicesPattern,
54+
ruleIndex
55+
);
4856
detectorTypeToIndicesMapping.put(detectorType.getDetectorType(), monitor);
4957
});
5058
}
@@ -76,7 +84,14 @@ public static String getAlertsHistoryIndexPattern(String detectorType) {
7684
public static String getAllAlertsIndicesPattern(String detectorType) {
7785
return detectorTypeToIndicesMapping.containsKey(detectorType) ?
7886
detectorTypeToIndicesMapping.get(detectorType).getAllAlertsIndicesPattern() :
79-
"*";
87+
OPENSEARCH_DEFAULT_ALL_ALERT_INDICES_PATTERN;
88+
}
89+
90+
public static List<String> getAllAlertsIndicesPatternForAllTypes() {
91+
return detectorTypeToIndicesMapping.entrySet()
92+
.stream()
93+
.map(e -> e.getValue().getAllAlertsIndicesPattern())
94+
.collect(Collectors.toList());
8095
}
8196

8297
public static String getFindingsIndex(String detectorType) {
@@ -85,6 +100,19 @@ public static String getFindingsIndex(String detectorType) {
85100
OPENSEARCH_DEFAULT_FINDINGS_INDEX;
86101
}
87102

103+
public static String getAllFindingsIndicesPattern(String detectorType) {
104+
return detectorTypeToIndicesMapping.containsKey(detectorType) ?
105+
detectorTypeToIndicesMapping.get(detectorType).getAllFindingsIndicesPattern() :
106+
OPENSEARCH_DEFAULT_ALL_FINDINGS_INDICES_PATTERN;
107+
}
108+
109+
public static List<String> getAllFindingsIndicesPatternForAllTypes() {
110+
return detectorTypeToIndicesMapping.entrySet()
111+
.stream()
112+
.map(e -> e.getValue().getAllFindingsIndicesPattern())
113+
.collect(Collectors.toList());
114+
}
115+
88116
public static String getFindingsIndexPattern(String detectorType) {
89117
return detectorTypeToIndicesMapping.containsKey(detectorType) ?
90118
detectorTypeToIndicesMapping.get(detectorType).getFindingsIndexPattern() :
@@ -106,6 +134,7 @@ public static class MonitorConfig {
106134
private final String allAlertsIndicesPattern;
107135
private final String findingIndex;
108136
private final String findingsIndexPattern;
137+
private final String allFindingsIndicesPattern;
109138
private final String ruleIndex;
110139

111140
private MonitorConfig(
@@ -115,6 +144,7 @@ private MonitorConfig(
115144
String allAlertsIndicesPattern,
116145
String findingsIndex,
117146
String findingsIndexPattern,
147+
String allFindingsIndicesPattern,
118148
String ruleIndex
119149
) {
120150
this.alertsIndex = alertsIndex;
@@ -123,6 +153,7 @@ private MonitorConfig(
123153
this.allAlertsIndicesPattern = allAlertsIndicesPattern;
124154
this.findingIndex = findingsIndex;
125155
this.findingsIndexPattern = findingsIndexPattern;
156+
this.allFindingsIndicesPattern = allFindingsIndicesPattern;
126157
this.ruleIndex = ruleIndex;
127158
}
128159

@@ -150,6 +181,10 @@ public String getFindingsIndexPattern() {
150181
return findingsIndexPattern;
151182
}
152183

184+
public String getAllFindingsIndicesPattern() {
185+
return allFindingsIndicesPattern;
186+
}
187+
153188
public String getRuleIndex() {
154189
return ruleIndex;
155190
}

‎src/main/java/org/opensearch/securityanalytics/findings/FindingsService.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -91,7 +91,7 @@ public void onFailure(Exception e) {
9191
FindingsService.this.getFindingsByMonitorIds(
9292
monitorToDetectorMapping,
9393
monitorIds,
94-
DetectorMonitorConfig.getFindingsIndex(detector.getDetectorType()),
94+
DetectorMonitorConfig.getAllFindingsIndicesPattern(detector.getDetectorType()),
9595
table,
9696
getFindingsResponseListener
9797
);
@@ -183,7 +183,7 @@ public void getFindings(
183183
FindingsService.this.getFindingsByMonitorIds(
184184
monitorToDetectorMapping,
185185
allMonitorIds,
186-
DetectorMonitorConfig.getFindingsIndex(detectorType.getDetectorType()),
186+
DetectorMonitorConfig.getAllFindingsIndicesPattern(detectorType.getDetectorType()),
187187
table,
188188
new ActionListener<>() {
189189
@Override

‎src/main/java/org/opensearch/securityanalytics/indexmanagment/DetectorIndexManagementService.java‎

Lines changed: 22 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -55,9 +55,6 @@ public class DetectorIndexManagementService extends AbstractLifecycleComponent i
5555

5656
private Logger logger = LogManager.getLogger(DetectorIndexManagementService.class);
5757

58-
private static final String ALERT_HISTORY_ALL = ".opensearch-sap-alerts-history-*";
59-
private static final String FINDING_HISTORY_ALL = ".opensearch-sap-findings-*";
60-
6158
private final Client client;
6259
private final ThreadPool threadPool;
6360
private final ClusterService clusterService;
@@ -235,7 +232,7 @@ private String executorName() {
235232
return ThreadPool.Names.MANAGEMENT;
236233
}
237234

238-
private void deleteOldIndices(String tag, String indices) {
235+
private void deleteOldIndices(String tag, String... indices) {
239236
logger.error("info deleteOldIndices");
240237
ClusterStateRequest clusterStateRequest = new ClusterStateRequest()
241238
.clear()
@@ -250,7 +247,7 @@ private void deleteOldIndices(String tag, String indices) {
250247
public void onResponse(ClusterStateResponse clusterStateResponse) {
251248
if (!clusterStateResponse.getState().metadata().getIndices().isEmpty()) {
252249
List<String> indicesToDelete = getIndicesToDelete(clusterStateResponse);
253-
logger.info("Deleting old " + tag + " indices viz $indicesToDelete");
250+
logger.info("Checking if we should delete " + tag + " indices: [" + indicesToDelete + "]");
254251
deleteAllOldHistoryIndices(indicesToDelete);
255252
} else {
256253
logger.info("No Old " + tag + " Indices to delete");
@@ -269,12 +266,14 @@ private List<String> getIndicesToDelete(ClusterStateResponse clusterStateRespons
269266
List<String> indicesToDelete = new ArrayList<>();
270267
for (ObjectCursor<IndexMetadata> in : clusterStateResponse.getState().metadata().indices().values()) {
271268
IndexMetadata indexMetaData = in.value;
272-
indicesToDelete.add(
273-
getHistoryIndexToDelete(indexMetaData, alertHistoryRetentionPeriod.millis(), alertHistoryIndices, alertHistoryEnabled)
274-
);
275-
indicesToDelete.add(
276-
getHistoryIndexToDelete(indexMetaData, findingHistoryRetentionPeriod.millis(), findingHistoryIndices, findingHistoryEnabled)
277-
);
269+
String indexToDelete = getHistoryIndexToDelete(indexMetaData, alertHistoryRetentionPeriod.millis(), alertHistoryIndices, alertHistoryEnabled);
270+
if (indexToDelete != null) {
271+
indicesToDelete.add(indexToDelete);
272+
}
273+
indexToDelete = getHistoryIndexToDelete(indexMetaData, findingHistoryRetentionPeriod.millis(), findingHistoryIndices, findingHistoryEnabled);
274+
if (indexToDelete != null) {
275+
indicesToDelete.add(indexToDelete);
276+
}
278277
}
279278
return indicesToDelete;
280279
}
@@ -319,15 +318,17 @@ private void deleteAllOldHistoryIndices(List<String> indicesToDelete) {
319318
public void onResponse(AcknowledgedResponse deleteIndicesResponse) {
320319
if (!deleteIndicesResponse.isAcknowledged()) {
321320
logger.error(
322-
"Could not delete one or more Alerting/Finding history indices: $indicesToDelete. Retrying one by one."
321+
"Could not delete one or more Alerting/Finding history indices: [" + indicesToDelete + "]. Retrying one by one."
323322
);
324323
deleteOldHistoryIndex(indicesToDelete);
324+
} else {
325+
logger.info("Succsessfuly deleted indices: [" + indicesToDelete + "]");
325326
}
326327
}
327328

328329
@Override
329330
public void onFailure(Exception e) {
330-
logger.error("Delete for Alerting/Finding History Indices $indicesToDelete Failed. Retrying one By one.");
331+
logger.error("Delete for Alerting/Finding History Indices failed: [" + indicesToDelete + "]. Retrying one By one.");
331332
deleteOldHistoryIndex(indicesToDelete);
332333
}
333334
}
@@ -351,7 +352,7 @@ public void onResponse(AcknowledgedResponse acknowledgedResponse) {
351352

352353
@Override
353354
public void onFailure(Exception e) {
354-
logger.debug("Exception ${e.message} while deleting the index " + index);
355+
logger.debug("Exception: [" + e.getMessage() + "] while deleting the index " + index);
355356
}
356357
}
357358
);
@@ -360,12 +361,12 @@ public void onFailure(Exception e) {
360361

361362
private void rolloverAndDeleteAlertHistoryIndices() {
362363
if (alertHistoryEnabled) rolloverAlertHistoryIndices();
363-
deleteOldIndices("History", ALERT_HISTORY_ALL);
364+
deleteOldIndices("Alert", DetectorMonitorConfig.getAllAlertsIndicesPatternForAllTypes().toArray(new String[0]));
364365
}
365366

366367
private void rolloverAndDeleteFindingHistoryIndices() {
367368
if (findingHistoryEnabled) rolloverFindingHistoryIndices();
368-
deleteOldIndices("Finding", FINDING_HISTORY_ALL);
369+
deleteOldIndices("Finding", DetectorMonitorConfig.getAllFindingsIndicesPatternForAllTypes().toArray(new String[0]));
369370
}
370371

371372
private void rolloverIndex(
@@ -393,13 +394,13 @@ private void rolloverIndex(
393394
@Override
394395
public void onResponse(RolloverResponse rolloverResponse) {
395396
if (!rolloverResponse.isRolledOver()) {
396-
logger.info(index + "not rolled over. Conditions were: ${response.conditionStatus}");
397+
logger.info(index + "not rolled over. Conditions were: " + rolloverResponse.getConditionStatus());
397398
}
398399
}
399400

400401
@Override
401402
public void onFailure(Exception e) {
402-
logger.error(index + " not roll over failed.");
403+
logger.error("rollover failed for index [" + index + "].");
403404
}
404405
}
405406
);
@@ -417,9 +418,9 @@ private void rolloverAlertHistoryIndices() {
417418
private void rolloverFindingHistoryIndices() {
418419
for (HistoryIndexInfo h : findingHistoryIndices) {
419420
rolloverIndex(
420-
h.isInitialized, h.indexAlias,
421-
h.indexPattern, h.indexMappings,
422-
h.maxDocs, h.maxAge
421+
h.isInitialized, h.indexAlias,
422+
h.indexPattern, h.indexMappings,
423+
h.maxDocs, h.maxAge
423424
);
424425
}
425426
}

‎src/test/java/org/opensearch/securityanalytics/SecurityAnalyticsRestTestCase.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1120,7 +1120,7 @@ public List<String> getAlertIndices(String detectorType) throws IOException {
11201120
}
11211121

11221122
public List<String> getFindingIndices(String detectorType) throws IOException {
1123-
Response response = client().performRequest(new Request("GET", "/_cat/indices/" + DetectorMonitorConfig.getFindingsIndex(detectorType) + "?format=json"));
1123+
Response response = client().performRequest(new Request("GET", "/_cat/indices/" + DetectorMonitorConfig.getAllFindingsIndicesPattern(detectorType) + "?format=json"));
11241124
XContentParser xcp = createParser(XContentType.JSON.xContent(), response.getEntity().getContent());
11251125
List<Object> responseList = xcp.list();
11261126
List<String> indices = new ArrayList<>();

0 commit comments

Comments
 (0)