Feat: Export Events

etc/export_events.tpl

@@ -0,0 +1,42 @@
+{
+  "index_patterns": ["export_events*"],  // Pattern to match the names of indices that should use this template
+  "settings": {
+    "number_of_shards": 1,  // Adjust based on expected load and data volume
+    "number_of_replicas": 1,  // Can be adjusted for high availability
+    "refresh_interval": "5s"  // Adjust based on write and query performance needs
+  },
+  "mappings": {
+    "properties": {
+      "project_id": {
+        "type": "keyword"  // Using keyword type for exact value matching and aggregations
+      },
+      "enabled": {
+        "type": "boolean"  // Boolean type for enabled/disabled status
+      },
+      "bucket_name": {
+        "type": "keyword"  // Using keyword to facilitate exact matches
+      },
+      "last_run_time": {
+        "type": "date",  // Date type for timestamping the last run
+        "format": "epoch_millisecond"  // Storing timestamp in milliseconds since the epoch
+      },
+      "filters": {
+        "type": "object",  // Object type to nest filter configurations
+        "properties": {
+          "event_types": {
+            "type": "keyword"  // Array of keywords for event types
+          },
+          "resource_types": {
+            "type": "keyword"  // Array of keywords for resource types
+          },
+          "exclude_event_types": {
+            "type": "keyword"  // Array of keywords for excluded event types
+          },
+          "exclude_resource_types": {
+            "type": "keyword"  // Array of keywords for excluded resource types
+          }
+        }
+      }
+    }
+  }
+}

etc/hermes.conf

@@ -2,6 +2,7 @@
 #storage_driver = "mock"
 #keystone_driver = "mock"
 PolicyFilePath = "etc/policy.json"
+ElasticTemplatePath = "etc/export_events.tpl"
 
 [elasticsearch]
 url = "http://localhost:9200"

internal/storage/elasticsearch.go

@@ -24,6 +24,8 @@ import (
 	"encoding/json"
 	"fmt"
 	"log"
+	"os"
+	"path/filepath"
 	"strings"
 
 	elastic "github.com/olivere/elastic/v7"
@@ -84,6 +86,39 @@ func (es *ElasticSearch) init() {
 		// If issues - https://github.com/olivere/elastic/wiki/Connection-Problems#how-to-figure-out-connection-problems
 		panic(err)
 	}
+
+	// Ensure the index template is checked and created if not exists
+	es.EnsureIndexTemplate()
+}
+
+// EnsureIndexTemplate checks if the composable index template exists, and if not, creates it.
+func (es *ElasticSearch) EnsureIndexTemplate() {
+	templateName := "export_events"
+	// TODO read from config file the path to the template
+	templatePath := filepath.Join("etc", "export_events.tpl")
+
+	templateContent, err := os.ReadFile(templatePath)
+	if err != nil {
+		logg.Error("Failed to read index template file: %v", err)
+		return
+	}
+
+	// Initialize the component template service
+	service := elastic.NewIndicesPutComponentTemplateService(es.client())
+	service.Name(templateName).BodyString(string(templateContent))
+
+	// Execute the request to create or update the component template
+	response, err := service.Do(context.Background())
+	if err != nil {
+		logg.Error("Failed to create or update the component template: %v", err)
+		return
+	}
+
+	if response.Acknowledged {
+		logg.Info("Component template created or updated successfully")
+	} else {
+		logg.Info("Component template creation or update not acknowledged")
+	}
 }
 
 // Mapping for attributes based on return values to API