Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

tsctl archive sketches #3090

Open
jkppr opened this issue May 14, 2024 · 1 comment
Open

tsctl archive sketches #3090

jkppr opened this issue May 14, 2024 · 1 comment

Comments

@jkppr
Copy link
Collaborator

jkppr commented May 14, 2024

Is your feature request related to a problem? Please describe.
With a larger Timesketch setup, over time there can be many searchindex instances opened on the opensearch cluster. It is possible to manually archive a sketch in the UI which will close the searchindex on the opensearch side, limiting the consumption of resources.

Describe the solution you'd like
For an easy clean-up and resource management, I propose a feature in the tsctl admin tool that allows to easily archiving all sketches that are have not been touched for the last X days.

Describe alternatives you've considered
This can also be done with an external script and the API. However, having it integrated into the admin tool makes sense to me.

https://github.com/google/timesketch/blob/master/timesketch/tsctl.py

@Abhishek-jha-96
Copy link

Abhishek-jha-96 commented Jul 1, 2024

@jkppr
Please clarify the use case:

  • we using cli give the command for example: archive --days 60
    so it will filter based on the Number of days provided and trigger a task(celery). which periodically archive sketches which are last updated more that say 60 days.
    also please specify the state of being archive in terms of backend.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants