diff --git a/CHANGES b/CHANGES index e0a73fe..1094cdb 100644 --- a/CHANGES +++ b/CHANGES @@ -1,5 +1,6 @@ -v0.3.4 Made datastream names consistent with ES expectations if -d is used without an index name. -v0.3.3 Added best compression option and fixed helper script. +v0.3.5 Removed need for trailing slash on ES URL. +v0.3.4 Made datastream names consistent with ES expectations if -d is used without an index name. +v0.3.3 Added best compression option and fixed helper script. v0.3.2 Fixed a bug with a grep command. v0.3.1 Added more logic to make ready for Elastic v8. v0.3.0 Added filtering on keys. Cleaned up some argparse logic, breaking previous command lines. diff --git a/zeek2es.py b/zeek2es.py index c8fea2f..7af408f 100644 --- a/zeek2es.py +++ b/zeek2es.py @@ -87,13 +87,13 @@ def senddatastream(args, es_index, mappings): auth = HTTPBasicAuth(args['user'], args['passwd']) lifecycle_policy = {"policy": {"phases": {"hot": {"actions": {"rollover": {"max_primary_shard_size": "{}GB".format(args['datastream'])}}}}}} - res = requests.put(args['esurl']+"_ilm/policy/zeek-lifecycle-policy", headers={'Content-Type': 'application/json'}, + res = requests.put(args['esurl']+"/_ilm/policy/zeek-lifecycle-policy", headers={'Content-Type': 'application/json'}, data=json.dumps(lifecycle_policy).encode('UTF-8'), auth=auth, verify=False) index_template = {"index_patterns": [es_index], "data_stream": {}, "composed_of": [], "priority": 500, "template": {"settings": {"index.lifecycle.name": "zeek-lifecycle-policy"}, "mappings": mappings["mappings"]}} if (args['compress']): index_template["template"]["settings"]["index"] = {"codec": "best_compression"} - res = requests.put(args['esurl']+"_index_template/"+es_index, headers={'Content-Type': 'application/json'}, + res = requests.put(args['esurl']+"/_index_template/"+es_index, headers={'Content-Type': 'application/json'}, data=json.dumps(index_template).encode('UTF-8'), auth=auth, verify=False) # A function to send mappings to ES. @@ -103,7 +103,7 @@ def sendmappings(args, es_index, mappings): if (len(args['user']) > 0): auth = HTTPBasicAuth(args['user'], args['passwd']) - res = requests.put(args['esurl']+es_index, headers={'Content-Type': 'application/json'}, + res = requests.put(args['esurl']+"/"+es_index, headers={'Content-Type': 'application/json'}, data=json.dumps(mappings).encode('UTF-8'), auth=auth, verify=False) # A function to send the ingest pipeline to ES. @@ -113,7 +113,7 @@ def sendpipeline(args, ingest_pipeline): if (len(args['user']) > 0): auth = HTTPBasicAuth(args['user'], args['passwd']) - res = requests.put(args['esurl']+"_ingest/pipeline/zeekgeoip", headers={'Content-Type': 'application/json'}, + res = requests.put(args['esurl']+"/_ingest/pipeline/zeekgeoip", headers={'Content-Type': 'application/json'}, data=json.dumps(ingest_pipeline).encode('UTF-8'), auth=auth, verify=False) # Everything important is in here.