From b002f2f56b093a5b8c519976be5e0f7790057de3 Mon Sep 17 00:00:00 2001
From: SG <mero.mero.guero@gmail.com>
Date: Tue, 16 Jan 2024 07:33:09 -0700
Subject: [PATCH] customizing index settings work in progress,
 idaholab/Malcolm#313

---
 scripts/install.py                        | 2 +-
 shared/bin/opensearch_index_size_prune.py | 5 ++++-
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/scripts/install.py b/scripts/install.py
index 7a6c61f90..95f307c8c 100755
--- a/scripts/install.py
+++ b/scripts/install.py
@@ -1038,7 +1038,7 @@ def tweak_malcolm_runtime(self, malcolm_install_path):
                         'Enter index threshold (e.g., 250GB, 1TB, 60%, etc.)', default=args.indexPruneSizeLimit
                     )
                 indexPruneNameSort = InstallerYesOrNo(
-                    'Determine oldest indices by name (instead of creation time)?', default=True
+                    'Determine oldest indices by name (instead of creation time)?', default=False
                 )
 
             # let Arkime delete old PCAP files based on available storage
diff --git a/shared/bin/opensearch_index_size_prune.py b/shared/bin/opensearch_index_size_prune.py
index 273dbed7b..ffcf5901e 100755
--- a/shared/bin/opensearch_index_size_prune.py
+++ b/shared/bin/opensearch_index_size_prune.py
@@ -39,7 +39,6 @@ def main():
         default=str2bool(os.getenv('OPENSEARCH_INDEX_SIZE_PRUNE_DEBUG', default='False')),
         help="Verbose output",
     )
-    # TODO: allow specifying two indices (e.g., MALCOLM_NETWORK_INDEX_PATTERN may be different than ARKIME_NETWORK_INDEX_PATTERN)
     parser.add_argument(
         '-i',
         '--index',
@@ -49,6 +48,7 @@ def main():
         default=[
             os.getenv('MALCOLM_NETWORK_INDEX_PATTERN', 'arkime_sessions3-*'),
             os.getenv('ARKIME_NETWORK_INDEX_PATTERN', 'arkime_sessions3-*'),
+            os.getenv('MALCOLM_OTHER_INDEX_PATTERN', 'malcolm_beats_*'),
         ],
         help='Index pattern(s)',
     )
@@ -280,6 +280,9 @@ def main():
                 osInfo['_all']['primaries' if args.primaryTotals else 'total']['store']['size_in_bytes'] // 1000000
             )
             totalIndices = totalIndices + len(osInfo["indices"])
+        except KeyError:
+            # just means there aren't any indices of this type yet, ignore it
+            pass
         except Exception as e:
             raise Exception(f'Error getting {idx} size_in_bytes: {e}')
     if debug: