Sort commands by its delivery timeout #155

AlexRuiz7 · 2024-11-29T17:43:02Z

Description

Update the CM plugin scheduled job to sort the commands in ascending order by the delivery_timestamp field.

Related issue: wazuh/wazuh-indexer#565

Depends on: #87

Implementation restrictions

Use OpenSearch queries to perform the sorting.

The text was updated successfully, but these errors were encountered:

QU3B1M · 2024-12-05T16:52:48Z

Update SearchThread.pitQuery method replacing the sorts by ORDER_ID and TIMEOUT with DELIVERY_TIMESTAMP

    public SearchResponse pitQuery(PointInTimeBuilder pointInTimeBuilder, Object[] searchAfter)
            throws IllegalStateException {
        ...
        if (this.searchSourceBuilder.sorts() == null) {
-            this.searchSourceBuilder
-                    .sort(SearchThread.COMMAND_ORDER_ID_FIELD, SortOrder.ASC)
-                    .sort(SearchThread.COMMAND_TIMEOUT_FIELD, SortOrder.ASC);
+            this.searchSourceBuilder.sort(SearchThread.DELIVERY_TIMESTAMP_FIELD, SortOrder.ASC);
        }

Sorted hits

{
    "_index": ".commands",
    "_id": "nPeRl5MB624UXaO3F_Bd",
    "_score": null,
    "_source": {
        "agent": {
            "groups": [
                "groups000"
            ]
        },
        "command": {
            "source": "Engine",
            "user": "user53",
            "target": {
                "type": "agent",
                "id": "target4"
            },
            "action": {
                "name": "restart",
                "args": [],
                "version": "v4"
            },
            "timeout": 30,
            "status": "PENDING",
            "order_id": "lfeRl5MB624UXaO3F_Bc",
            "request_id": "lPeRl5MB624UXaO3F_Bc"
        },
        "@timestamp": "2024-12-05T16:04:48Z",
        "delivery_timestamp": "2024-12-05T16:05:18Z"
    },
    "sort": [
        1733414718000
    ]
},
{
    "_index": ".commands",
    "_id": "nfeRl5MB624UXaO3F_Bf",
    "_score": null,
    "_source": {
        "agent": {
            "groups": [
                "groups000"
            ]
        },
        "command": {
            "source": "Engine",
            "user": "user53",
            "target": {
                "type": "agent",
                "id": "target4"
            },
            "action": {
                "name": "restart",
                "args": [
                    "/path/to/executable/arg6",
                    "/path/to/executable/arg6"
                ],
                "version": "v4"
            },
            "timeout": 30,
            "status": "PENDING",
            "order_id": "l_eRl5MB624UXaO3F_Bc",
            "request_id": "lveRl5MB624UXaO3F_Bc"
        },
        "@timestamp": "2024-12-05T16:04:48Z",
        "delivery_timestamp": "2024-12-05T16:05:18Z"
    },
    "sort": [
        1733414718000
    ]
},
{
    "_index": ".commands",
    "_id": "nveRl5MB624UXaO3F_Bf",
    "_score": null,
    "_source": {
        "agent": {
            "groups": [
                "groups000"
            ]
        },
        "command": {
            "source": "Engine",
            "user": "user53",
            "target": {
                "type": "agent",
                "id": "target4"
            },
            "action": {
                "name": "restart",
                "args": [
                    "/path/to/executable/arg6",
                    "/path/to/executable/arg6",
                    "/path/to/executable/arg6"
                ],
                "version": "v4"
            },
            "timeout": 30,
            "status": "PENDING",
            "order_id": "mfeRl5MB624UXaO3F_Bc",
            "request_id": "mPeRl5MB624UXaO3F_Bc"
        },
        "@timestamp": "2024-12-05T16:04:48Z",
        "delivery_timestamp": "2024-12-05T16:05:18Z"
    },
    "sort": [
        1733414718000
    ]
},
{
    "_index": ".commands",
    "_id": "n_eRl5MB624UXaO3F_Bf",
    "_score": null,
    "_source": {
        "agent": {
            "groups": [
                "groups000"
            ]
        },
        "command": {
            "source": "Engine",
            "user": "user53",
            "target": {
                "type": "agent",
                "id": "target4"
            },
            "action": {
                "name": "restart",
                "args": [
                    "/path/to/executable/arg6",
                    "/path/to/executable/arg6",
                    "/path/to/executable/arg6",
                    "/path/to/executable/arg6",
                    "/path/to/executable/arg6"
                ],
                "version": "v4"
            },
            "timeout": 30,
            "status": "PENDING",
            "order_id": "m_eRl5MB624UXaO3F_Bc",
            "request_id": "mveRl5MB624UXaO3F_Bc"
        },
        "@timestamp": "2024-12-05T16:04:48Z",
        "delivery_timestamp": "2024-12-05T16:05:18Z"
    },
    "sort": [
        1733414718000
    ]
},
{
    "_index": ".commands",
    "_id": "q_eRl5MB624UXaO3NfCO",
    "_score": null,
    "_source": {
        "agent": {
            "groups": [
                "groups000"
            ]
        },
        "command": {
            "source": "Users/Services",
            "user": "user74",
            "target": {
                "type": "server",
                "id": "target3"
            },
            "action": {
                "name": "update",
                "args": [
                    "/path/to/executable/arg2"
                ],
                "version": "v5"
            },
            "timeout": 24,
            "status": "PENDING",
            "order_id": "o_eRl5MB624UXaO3NfCN",
            "request_id": "oveRl5MB624UXaO3NfCN"
        },
        "@timestamp": "2024-12-05T16:04:56Z",
        "delivery_timestamp": "2024-12-05T16:05:20Z"
    },
    "sort": [
        1733414720000
    ]
},
{
    "_index": ".commands",
    "_id": "uveRl5MB624UXaO3RPAx",
    "_score": null,
    "_source": {
        "agent": {
            "groups": [
                "groups000"
            ]
        },
        "command": {
            "source": "Engine",
            "user": "user52",
            "target": {
                "type": "server",
                "id": "target7"
            },
            "action": {
                "name": "apply_policy",
                "args": [
                    "/path/to/executable/arg6"
                ],
                "version": "v5"
            },
            "timeout": 28,
            "status": "PENDING",
            "order_id": "sveRl5MB624UXaO3RPAx",
            "request_id": "sfeRl5MB624UXaO3RPAx"
        },
        "@timestamp": "2024-12-05T16:05:00Z",
        "delivery_timestamp": "2024-12-05T16:05:28Z"
    },
    "sort": [
        1733414728000
    ]
},
{
    "_index": ".commands",
    "_id": "vfeRl5MB624UXaO3RPAx",
    "_score": null,
    "_source": {
        "agent": {
            "groups": [
                "groups000"
            ]
        },
        "command": {
            "source": "Users/Services",
            "user": "user74",
            "target": {
                "type": "agent",
                "id": "target4"
            },
            "action": {
                "name": "update",
                "args": [
                    "/path/to/executable/arg10"
                ],
                "version": "v5"
            },
            "timeout": 35,
            "status": "PENDING",
            "order_id": "uPeRl5MB624UXaO3RPAx",
            "request_id": "t_eRl5MB624UXaO3RPAx"
        },
        "@timestamp": "2024-12-05T16:05:00Z",
        "delivery_timestamp": "2024-12-05T16:05:35Z"
    },
    "sort": [
        1733414735000
    ]
},
{
    "_index": ".commands",
    "_id": "u_eRl5MB624UXaO3RPAx",
    "_score": null,
    "_source": {
        "agent": {
            "groups": [
                "groups000"
            ]
        },
        "command": {
            "source": "Users/Services",
            "user": "user99",
            "target": {
                "type": "agent",
                "id": "target1"
            },
            "action": {
                "name": "restart",
                "args": [
                    "/path/to/executable/arg6"
                ],
                "version": "v3"
            },
            "timeout": 42,
            "status": "PENDING",
            "order_id": "tPeRl5MB624UXaO3RPAx",
            "request_id": "s_eRl5MB624UXaO3RPAx"
        },
        "@timestamp": "2024-12-05T16:05:00Z",
        "delivery_timestamp": "2024-12-05T16:05:42Z"
    },
    "sort": [
        1733414742000
    ]
},
{
    "_index": ".commands",
    "_id": "qveRl5MB624UXaO3NfCO",
    "_score": null,
    "_source": {
        "agent": {
            "groups": [
                "groups000"
            ]
        },
        "command": {
            "source": "Users/Services",
            "user": "user99",
            "target": {
                "type": "group",
                "id": "target5"
            },
            "action": {
                "name": "restart",
                "args": [
                    "/path/to/executable/arg7"
                ],
                "version": "v5"
            },
            "timeout": 47,
            "status": "PENDING",
            "order_id": "ofeRl5MB624UXaO3NfCN",
            "request_id": "oPeRl5MB624UXaO3NfCN"
        },
        "@timestamp": "2024-12-05T16:04:56Z",
        "delivery_timestamp": "2024-12-05T16:05:43Z"
    },
    "sort": [
        1733414743000
    ]
},
{
    "_index": ".commands",
    "_id": "ufeRl5MB624UXaO3RPAx",
    "_score": null,
    "_source": {
        "agent": {
            "groups": [
                "groups000"
            ]
        },
        "command": {
            "source": "Users/Services",
            "user": "user90",
            "target": {
                "type": "agent",
                "id": "target5"
            },
            "action": {
                "name": "restart",
                "args": [
                    "/path/to/executable/arg8"
                ],
                "version": "v1"
            },
            "timeout": 54,
            "status": "PENDING",
            "order_id": "sPeRl5MB624UXaO3RPAx",
            "request_id": "r_eRl5MB624UXaO3RPAx"
        },
        "@timestamp": "2024-12-05T16:05:00Z",
        "delivery_timestamp": "2024-12-05T16:05:54Z"
    },
    "sort": [
        1733414754000
    ]
},
{
    "_index": ".commands",
    "_id": "rPeRl5MB624UXaO3NfCO",
    "_score": null,
    "_source": {
        "agent": {
            "groups": [
                "groups000"
            ]
        },
        "command": {
            "source": "Users/Services",
            "user": "user68",
            "target": {
                "type": "server",
                "id": "target8"
            },
            "action": {
                "name": "update",
                "args": [
                    "/path/to/executable/arg2"
                ],
                "version": "v1"
            },
            "timeout": 65,
            "status": "PENDING",
            "order_id": "pfeRl5MB624UXaO3NfCN",
            "request_id": "pPeRl5MB624UXaO3NfCN"
        },
        "@timestamp": "2024-12-05T16:04:56Z",
        "delivery_timestamp": "2024-12-05T16:06:01Z"
    },
    "sort": [
        1733414761000
    ]
},
{
    "_index": ".commands",
    "_id": "vPeRl5MB624UXaO3RPAx",
    "_score": null,
    "_source": {
        "agent": {
            "groups": [
                "groups000"
            ]
        },
        "command": {
            "source": "Content manager",
            "user": "user73",
            "target": {
                "type": "group",
                "id": "target4"
            },
            "action": {
                "name": "apply_policy",
                "args": [
                    "/path/to/executable/arg6"
                ],
                "version": "v2"
            },
            "timeout": 67,
            "status": "PENDING",
            "order_id": "tveRl5MB624UXaO3RPAx",
            "request_id": "tfeRl5MB624UXaO3RPAx"
        },
        "@timestamp": "2024-12-05T16:05:00Z",
        "delivery_timestamp": "2024-12-05T16:06:07Z"
    },
    "sort": [
        1733414767000
    ]
},
{
    "_index": ".commands",
    "_id": "rfeRl5MB624UXaO3NfCO",
    "_score": null,
    "_source": {
        "agent": {
            "groups": [
                "groups000"
            ]
        },
        "command": {
            "source": "Users/Services",
            "user": "user55",
            "target": {
                "type": "agent",
                "id": "target2"
            },
            "action": {
                "name": "apply_policy",
                "args": [
                    "/path/to/executable/arg6"
                ],
                "version": "v5"
            },
            "timeout": 73,
            "status": "PENDING",
            "order_id": "p_eRl5MB624UXaO3NfCO",
            "request_id": "pveRl5MB624UXaO3NfCN"
        },
        "@timestamp": "2024-12-05T16:04:56Z",
        "delivery_timestamp": "2024-12-05T16:06:09Z"
    },
    "sort": [
        1733414769000
    ]
},
{
    "_index": ".commands",
    "_id": "rveRl5MB624UXaO3NfCO",
    "_score": null,
    "_source": {
        "agent": {
            "groups": [
                "groups000"
            ]
        },
        "command": {
            "source": "Content manager",
            "user": "user34",
            "target": {
                "type": "agent",
                "id": "target7"
            },
            "action": {
                "name": "change_group",
                "args": [
                    "/path/to/executable/arg2"
                ],
                "version": "v5"
            },
            "timeout": 90,
            "status": "PENDING",
            "order_id": "qfeRl5MB624UXaO3NfCO",
            "request_id": "qPeRl5MB624UXaO3NfCO"
        },
        "@timestamp": "2024-12-05T16:04:56Z",
        "delivery_timestamp": "2024-12-05T16:06:26Z"
    },
    "sort": [
        1733414786000
    ]
}

Orders payload

{
    "orders": [
        {
            "action": {
                "args": [],
                "name": "restart",
                "version": "v4"
            },
            "source": "Engine",
            "document_id": "nPeRl5MB624UXaO3F_Bd",
            "user": "user53",
            "order_id": "lfeRl5MB624UXaO3F_Bc",
            "request_id": "lPeRl5MB624UXaO3F_Bc",
            "timeout": 30,
            "target": {
                "id": "target4",
                "type": "agent"
            },
            "status": "PENDING"
        },
        {
            "action": {
                "args": [
                    "/path/to/executable/arg6",
                    "/path/to/executable/arg6"
                ],
                "name": "restart",
                "version": "v4"
            },
            "source": "Engine",
            "document_id": "nfeRl5MB624UXaO3F_Bf",
            "user": "user53",
            "order_id": "l_eRl5MB624UXaO3F_Bc",
            "request_id": "lveRl5MB624UXaO3F_Bc",
            "timeout": 30,
            "target": {
                "id": "target4",
                "type": "agent"
            },
            "status": "PENDING"
        },
        {
            "action": {
                "args": [
                    "/path/to/executable/arg6",
                    "/path/to/executable/arg6",
                    "/path/to/executable/arg6"
                ],
                "name": "restart",
                "version": "v4"
            },
            "source": "Engine",
            "document_id": "nveRl5MB624UXaO3F_Bf",
            "user": "user53",
            "order_id": "mfeRl5MB624UXaO3F_Bc",
            "request_id": "mPeRl5MB624UXaO3F_Bc",
            "timeout": 30,
            "target": {
                "id": "target4",
                "type": "agent"
            },
            "status": "PENDING"
        },
        {
            "action": {
                "args": [
                    "/path/to/executable/arg6",
                    "/path/to/executable/arg6",
                    "/path/to/executable/arg6",
                    "/path/to/executable/arg6",
                    "/path/to/executable/arg6"
                ],
                "name": "restart",
                "version": "v4"
            },
            "source": "Engine",
            "document_id": "n_eRl5MB624UXaO3F_Bf",
            "user": "user53",
            "order_id": "m_eRl5MB624UXaO3F_Bc",
            "request_id": "mveRl5MB624UXaO3F_Bc",
            "timeout": 30,
            "target": {
                "id": "target4",
                "type": "agent"
            },
            "status": "PENDING"
        },
        {
            "action": {
                "args": [
                    "/path/to/executable/arg2"
                ],
                "name": "update",
                "version": "v5"
            },
            "source": "Users/Services",
            "document_id": "q_eRl5MB624UXaO3NfCO",
            "user": "user74",
            "order_id": "o_eRl5MB624UXaO3NfCN",
            "request_id": "oveRl5MB624UXaO3NfCN",
            "timeout": 24,
            "target": {
                "id": "target3",
                "type": "server"
            },
            "status": "PENDING"
        },
        {
            "action": {
                "args": [
                    "/path/to/executable/arg6"
                ],
                "name": "apply_policy",
                "version": "v5"
            },
            "source": "Engine",
            "document_id": "uveRl5MB624UXaO3RPAx",
            "user": "user52",
            "order_id": "sveRl5MB624UXaO3RPAx",
            "request_id": "sfeRl5MB624UXaO3RPAx",
            "timeout": 28,
            "target": {
                "id": "target7",
                "type": "server"
            },
            "status": "PENDING"
        },
        {
            "action": {
                "args": [
                    "/path/to/executable/arg10"
                ],
                "name": "update",
                "version": "v5"
            },
            "source": "Users/Services",
            "document_id": "vfeRl5MB624UXaO3RPAx",
            "user": "user74",
            "order_id": "uPeRl5MB624UXaO3RPAx",
            "request_id": "t_eRl5MB624UXaO3RPAx",
            "timeout": 35,
            "target": {
                "id": "target4",
                "type": "agent"
            },
            "status": "PENDING"
        },
        {
            "action": {
                "args": [
                    "/path/to/executable/arg6"
                ],
                "name": "restart",
                "version": "v3"
            },
            "source": "Users/Services",
            "document_id": "u_eRl5MB624UXaO3RPAx",
            "user": "user99",
            "order_id": "tPeRl5MB624UXaO3RPAx",
            "request_id": "s_eRl5MB624UXaO3RPAx",
            "timeout": 42,
            "target": {
                "id": "target1",
                "type": "agent"
            },
            "status": "PENDING"
        },
        {
            "action": {
                "args": [
                    "/path/to/executable/arg7"
                ],
                "name": "restart",
                "version": "v5"
            },
            "source": "Users/Services",
            "document_id": "qveRl5MB624UXaO3NfCO",
            "user": "user99",
            "order_id": "ofeRl5MB624UXaO3NfCN",
            "request_id": "oPeRl5MB624UXaO3NfCN",
            "timeout": 47,
            "target": {
                "id": "target5",
                "type": "group"
            },
            "status": "PENDING"
        },
        {
            "action": {
                "args": [
                    "/path/to/executable/arg8"
                ],
                "name": "restart",
                "version": "v1"
            },
            "source": "Users/Services",
            "document_id": "ufeRl5MB624UXaO3RPAx",
            "user": "user90",
            "order_id": "sPeRl5MB624UXaO3RPAx",
            "request_id": "r_eRl5MB624UXaO3RPAx",
            "timeout": 54,
            "target": {
                "id": "target5",
                "type": "agent"
            },
            "status": "PENDING"
        },
        {
            "action": {
                "args": [
                    "/path/to/executable/arg2"
                ],
                "name": "update",
                "version": "v1"
            },
            "source": "Users/Services",
            "document_id": "rPeRl5MB624UXaO3NfCO",
            "user": "user68",
            "order_id": "pfeRl5MB624UXaO3NfCN",
            "request_id": "pPeRl5MB624UXaO3NfCN",
            "timeout": 65,
            "target": {
                "id": "target8",
                "type": "server"
            },
            "status": "PENDING"
        },
        {
            "action": {
                "args": [
                    "/path/to/executable/arg6"
                ],
                "name": "apply_policy",
                "version": "v2"
            },
            "source": "Content manager",
            "document_id": "vPeRl5MB624UXaO3RPAx",
            "user": "user73",
            "order_id": "tveRl5MB624UXaO3RPAx",
            "request_id": "tfeRl5MB624UXaO3RPAx",
            "timeout": 67,
            "target": {
                "id": "target4",
                "type": "group"
            },
            "status": "PENDING"
        },
        {
            "action": {
                "args": [
                    "/path/to/executable/arg6"
                ],
                "name": "apply_policy",
                "version": "v5"
            },
            "source": "Users/Services",
            "document_id": "rfeRl5MB624UXaO3NfCO",
            "user": "user55",
            "order_id": "p_eRl5MB624UXaO3NfCO",
            "request_id": "pveRl5MB624UXaO3NfCN",
            "timeout": 73,
            "target": {
                "id": "target2",
                "type": "agent"
            },
            "status": "PENDING"
        },
        {
            "action": {
                "args": [
                    "/path/to/executable/arg2"
                ],
                "name": "change_group",
                "version": "v5"
            },
            "source": "Content manager",
            "document_id": "rveRl5MB624UXaO3NfCO",
            "user": "user34",
            "order_id": "qfeRl5MB624UXaO3NfCO",
            "request_id": "qPeRl5MB624UXaO3NfCO",
            "timeout": 90,
            "target": {
                "id": "target7",
                "type": "agent"
            },
            "status": "PENDING"
        }
    ]
}

AlexRuiz7 added level/task Task issue type/enhancement Enhancement issue mvp Minimum Viable Product labels Nov 29, 2024

AlexRuiz7 mentioned this issue Nov 29, 2024

Command manager timeseries index model wazuh/wazuh-indexer#565

Closed

4 tasks

AlexRuiz7 changed the title ~~Update the scheduled job to prioritize the commands by its timestamp (+ timeout)~~ Update the scheduled job to sort commands by its delivery timeout Nov 29, 2024

AlexRuiz7 changed the title ~~Update the scheduled job to sort commands by its delivery timeout~~ Sort commands by its delivery timeout Nov 29, 2024

wazuhci added this to Release 5.0.0 Nov 29, 2024

wazuhci moved this to Backlog in Release 5.0.0 Nov 29, 2024

wazuhci moved this from Backlog to Blocked in Release 5.0.0 Dec 3, 2024

AlexRuiz7 mentioned this issue Dec 4, 2024

The job runner sorts the commands by the timeout field (lower timeout, higher priority). #126

Closed

QU3B1M self-assigned this Dec 4, 2024

wazuhci moved this from Blocked to Backlog in Release 5.0.0 Dec 4, 2024

wazuhci moved this from Backlog to In progress in Release 5.0.0 Dec 5, 2024

QU3B1M mentioned this issue Dec 5, 2024

Update command-manager to sort documents by delivery timeout #169

Merged

wazuhci moved this from In progress to Pending review in Release 5.0.0 Dec 5, 2024

f-galland closed this as completed in #169 Dec 9, 2024

wazuhci moved this from Pending review to Done in Release 5.0.0 Dec 9, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Sort commands by its delivery timeout #155

Sort commands by its delivery timeout #155

AlexRuiz7 commented Nov 29, 2024 •

edited

Loading

QU3B1M commented Dec 5, 2024

Sort commands by its delivery timeout #155

Sort commands by its delivery timeout #155

Comments

AlexRuiz7 commented Nov 29, 2024 • edited Loading

Description

Implementation restrictions

QU3B1M commented Dec 5, 2024

AlexRuiz7 commented Nov 29, 2024 •

edited

Loading