Listing Event Attributes seen by Elasticsearch

The following tools are provided:

• listElasticEventAttributes.sh Tool

listElasticEventAttributes.sh Tool

Description: This tool gathers Elasticsearch event attributes for the number of days specified with the days value into a CSV file that can be used to prepare a custom Elastic Search Event Attribute Template file. This file can be uploaded to replace the default Event Attribute template, potentially reducing the number of Event Attributes that Elasticsearch needs to search by default. For information on where to upload the custom file, see Configuring Elasticsearch Based Deployments.

Usage: [root@FortiSIEM]#listElasticEventAtributes.sh destURL httpPort(9200) [user passwd] dayssocketTimeoutInMinuteoutputFile

Argument	Description
destURL	The destination URL, normally the Elasticsearch URL.
httpPort	The port number used to connect to Elasticsearch.
user	Use your login username to access Elasticsearch.
password	Use your password associated with the username to access Elasticsearch
days	The number of days you want this custom configuration to be applied, starting when the custom template is added to your Elasticsearch Based Deployment.
socketTimeoutInMinute	The maximum time out period value in minutes for the socket .
outputFile	The name you wish to name your output file.

Notes:

1. You can change an Event Attribute type per your requirements if the default type is not suitable, but you will need to upload the custom Event Attribute template afterward.
2. This tool is located in /opt/phoenix/config/javaQueryServer/.

Example:

[root@FortiSIEM javaQueryServer# ./listElasticEventAttributes.sh https://172.30.56.180 9200 "username" "password" 3 10 /tmp/1.csv