Initialization of the wazuh-content index

[f-galland]

Description

On start, the Content Manager will initialize the internal index to manage the context's metadata. The index name will be wazuh-content for now. This index will be read and written by other modules of the Content Manager:

• The CTI client writes the latest offset and the snapshot URL for the given context.
• The Content Updater reads the latest offset and the current offset to fetch the changes on the context. It updates the context's offset on each successful update.
• The Snapshot handler reads the snapshot URL.

[
  {
    "_index": "wazuh-content",
    "_id": "vd_1.0.0",
    "_source": {
      "vd_4.8.0": {
        "offset": 75019,
        "last_offset": 85729
      }
    }
  },
  {
    "_index": "wazuh-content",
    "_id": "vd_1.0.0",
    "_source": {
      "vd_4.8.0": {
        "offset": 0,
        "snapshot": "uri-to-snapshot",
        "hash": "snapshot-hash"
      }
    }
  }
]

On initialization, the context's offset is set to 0, to force an initialization from a snapshot. The context name is used as the document's ID (vd_1.0.0), and the consumer name as the object key for the metadata (vd_4.8.0).

Functional requirements

• The Content Manager initializes the wazuh-content index on start up, if it does not exist.
• The context's name is used as the document's ID.

Implementation restrictions

• The context and consumer names are set as constants in the code.
• JSON schema (mappings):
  • offset --> int
  • last_offset --> int
  • snapshot --> URL
  • hash --> string