clear data after running so-test

[dlazure]

Hi,

How do I clean my data after running so-test?

it shows a lot of alerts from the test and I would like to clean the data

thank you

[dougburks]

Take a look at so-elastic-clear. You might want to try it on a test box to make sure it does what you want it to do.

[dlazure]

exactly what I needed,

Thank you Doug,

[dougburks]

Added to documentation:
https://docs.securityonion.net/en/2.3/elasticsearch.html#clearing