#!/usr/bin/env bash
# Read-only capacity snapshot of a Wazuh 5.0 indexer: ingest rate, the
# endpoints producing most of it, index sizes and memory locking.
#
# Companion to: https://maheshtata.com/wazuh/wazuh-performance-tuning/
# Every endpoint used here is documented for Wazuh 5.0-beta. Nothing is
# written or changed. Output is printed raw and is not parsed.
#
# Usage:
#   INDEXER_URL=https://127.0.0.1:9200 \
#   INDEXER_USER=admin \
#   INDEXER_PASS='...' \
#     ./measure-eps.sh

set -euo pipefail

INDEXER_URL="${INDEXER_URL:-https://127.0.0.1:9200}"
INDEXER_USER="${INDEXER_USER:-admin}"
INDEXER_PASS="${INDEXER_PASS:?set INDEXER_PASS}"
WINDOW="${WINDOW:-now-1h}"
HERE="$(cd "$(dirname "$0")" && pwd)"

q() { curl -sk -u "${INDEXER_USER}:${INDEXER_PASS}" "$@"; }
hr() { printf '\n----- %s -----\n' "$1"; }

hr "cluster health"
q "${INDEXER_URL}/_cluster/health?pretty"

hr "memory locking (expect true on every node)"
q "${INDEXER_URL}/_nodes?filter_path=**.mlockall&pretty"

hr "wazuh indices by size"
q "${INDEXER_URL}/_cat/indices/wazuh-*?v&s=store.size:desc"

hr "ingest rate since ${WINDOW}"
# Strips the _comment key so the file stays self-documenting on disk.
BODY="$(python3 -c '
import json,sys
d=json.load(open(sys.argv[1]))
d.pop("_comment",None)
d["query"]["range"]["@timestamp"]["gte"]=sys.argv[2]
print(json.dumps(d))
' "${HERE}/eps-by-minute.json" "${WINDOW}")"

q -X GET "${INDEXER_URL}/wazuh-events-v5-*/_search?pretty" \
  -H 'Content-Type: application/json' \
  -d "${BODY}"

hr "stored Setup module settings"
# engine.index_raw_events controls whether every raw event is also indexed
# into wazuh-events-raw-v5. Turning it off is usually the largest single
# volume reduction available. The documented storage location for Setup
# module settings is the .wazuh-settings index; the documented way to change
# them is PUT /_plugins/_setup/settings.
q "${INDEXER_URL}/.wazuh-settings/_search?pretty"
echo