This is an WARNING alert box.
This is an ERROR alert box.
This is an INFO alert box.
Gather Elastic status output into Powershell to query
We are looking for a way of reporting back on the status of our Elastic agents via PDQ inventory. Currently we have the ability to run the command elastic-agent status and get an output either in human readable format or JSON. The output looks something like this:
:\Program Files\Elastic\Agent>elastic-agent.exe status --output json
{
"Status": 2,
"Message": "",
"Applications": [
{
"ID": "endpoint-security--8.3.3-xxxxxxxx",
"Name": "endpoint-security",
"Status": 2,
"Message": "Protecting with policy {0b6837ac-06fd-4e5e-8137-xxxxxxxxxxxxxf}",
"Payload": null
},
{
"ID": "filebeat--8.3.3-4b3087ec",
"Name": "filebeat",
"Status": 2,
"Message": "Running",
"Payload": null
}
]
}
Out of that data really we only care about the two status fields that are currently showing status = 2 (which means connected). I would very much like to be able to push this through a powershell scanner and be able to query on the status field but having a hard time making it all work. Any suggestions from the group how to format the output where powershell scanner could properly place it in the database for query?
Comments
Something like this?
I was far over-complicating this. Your command works perfectly. Thank you
Please sign in to leave a comment.