automatically create empty document on startup to avoid "no data" message spamming by Dashboards #527
Assignees
Labels
dashboards
Relating to Malcolm's OpenSearch Dashboards interface
elastic
Related to issue with external ElasticSearch/Kibana output
enhancement
New feature or request
opensearch
Relating to Malcolm's use of OpenSearch
UI
Relating to general UI experience
Milestone
Comments
mmguero
added
enhancement
|
Fixed via #567 |
mmguero
changed the title
This was referenced Sep 18, 2024
Merged
mmguero
added a commit
to mmguero-dev/Malcolm
that referenced
this issue
Oct 16, 2024
…reated two issues were present: 1. opensearch_status.sh -w was no longer behaving as previously, as now an empty index is being created that doesn't have any events in it (see idaholab#527 and idaholab#567). It's been adjusted so that now it waits for an index with docs.count > 0. 2. The shared_object_creation.sh script needed to create the dummy detector if the .opendistro-anomaly-detection-state doesn't exist, so this check has been put in place
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Today, if you open Dashboards without any data in the indexes you get spammed with this message about a thousand times about how thiere's no data in the arkime-sessions3-* index.
It would be cool if on startup (probably right about here) we indexed a single log that's just like a "Malcolm started up" log (easily distinguishable from other network metadata logs, but existing in the same database) so that there would at least be one document at all times. This would be done via the OpenSearch/Elasticsearch REST API directly (probably using cURL or something).
To determine the index that it would need to be written into we'd have to take into account the customizability of the index and calculate the index name pretty much like we do here.
Idea suggested by @ee-hex-ee
The text was updated successfully, but these errors were encountered: