Skip to content

Commit

Permalink
work for cisagov#542, preserve custom field formatting for index patt…
Browse files Browse the repository at this point in the history
…ern on update of index pattern
  • Loading branch information
mmguero committed Jan 17, 2025
1 parent 673d04d commit 50f841c
Showing 1 changed file with 15 additions and 2 deletions.
17 changes: 15 additions & 2 deletions dashboards/scripts/shared-object-creation.sh
Original file line number Diff line number Diff line change
Expand Up @@ -266,11 +266,24 @@ if [[ "${CREATE_OS_ARKIME_SESSION_INDEX:-true}" = "true" ]] ; then
echo "Importing index pattern..."
[[ "${TEMPLATES_IMPORTED}" == "true" ]] && SHOW_IMPORT_ERROR="--show-error" || SHOW_IMPORT_ERROR=

# Create index pattern
# Save off any custom field formatting prior to an overwrite
FIELD_FORMAT_MAP="$( curl "${CURL_CONFIG_PARAMS[@]}" -w "\n" --silent --location --fail -XGET -H "Content-Type: application/json" -H "$XSRF_HEADER: anything" \
"$DASHB_URL/api/saved_objects/index-pattern/${INDEX_PATTERN}" 2>/dev/null | \
jq -r '.attributes.fieldFormatMap' 2>/dev/null | \
jq -c 'with_entries(.value.params.parsedUrl? = null | del(.value.params.parsedUrl))' 2>/dev/null )" || true

# Create index pattern (preserving custom field formatting)
MALCOLM_INDEX_PATTERN_FILE_TEMP="$(mktemp)"
echo "{\"attributes\":{\"title\":\"$INDEX_PATTERN\",\"timeFieldName\":\"$INDEX_TIME_FIELD\"}}" > "$MALCOLM_INDEX_PATTERN_FILE_TEMP"
if [[ -n "$FIELD_FORMAT_MAP" ]] && [[ "$FIELD_FORMAT_MAP" != "null" ]]; then
echo "Preserving existing field formatting..."
jq --arg fieldFormatMap "$FIELD_FORMAT_MAP" '.attributes.fieldFormatMap = $fieldFormatMap' "$MALCOLM_INDEX_PATTERN_FILE_TEMP" | sponge "$MALCOLM_INDEX_PATTERN_FILE_TEMP"
fi
echo "Creating index pattern \"$INDEX_PATTERN\"..."
curl "${CURL_CONFIG_PARAMS[@]}" -w "\n" --location --fail --silent --output /dev/null ${SHOW_IMPORT_ERROR} -XPOST -H "Content-Type: application/json" -H "$XSRF_HEADER: anything" \
"$DASHB_URL/api/saved_objects/index-pattern/${INDEX_PATTERN}?overwrite=${TEMPLATES_IMPORTED}" \
-d"{\"attributes\":{\"title\":\"$INDEX_PATTERN\",\"timeFieldName\":\"$INDEX_TIME_FIELD\"}}" 2>&1 || true
-d @"$MALCOLM_INDEX_PATTERN_FILE_TEMP" 2>&1 || true
rm -f "$MALCOLM_INDEX_PATTERN_FILE_TEMP"

echo "Setting default index pattern..."

Expand Down

0 comments on commit 50f841c

Please sign in to comment.