Automating ELK Health Check

A little project I started to learn GoLang and "ELK_Health_Check" is now on my GitHub page. A script to automate some of the basic troubleshooting tasks to locate issues in an elasticsearch cluster.

Introduction

While I am not a programmer, in cybersecurity, scripting has always been a must skill to upgrade my skillset, and GoLang is gaining popularity specially among cybersecurity professionals for reasons I won't be talking about in this blog post. So, as a start, I tried to answer my needs in troubleshooting an Elasticsearch clusters and automate some of the frequent checks using GoLang since Elastic Stack is my favorite set of tools for threat hunting.

GitHub project repository: https://github.com/H1L021/ELK_Health_Check

ELK Health Check

Running ELK Health Check

This is a script that runs multiple basic checks for an Elasticsearch cluster health and saves everything to text files. The script runs the following checks:

1. Unavailable nodes based on the number of nodes you provide in your cluster.

2. Checks indices status (Green, Yellow, Red). Warns you if it detects Yellow indices or Red ones.

3. Verifies cluster's health using _cluster/health API call.

4. Checks allocation status using _cat/allocation API call

5. Looks and warns you for unassigned shards;

6. Creates a folder in current path and saves every output to files for later usage.

This script only supports cluster nodes using TLS for the moment.