From c9d9979f2250491025d7779731389f8153f4d833 Mon Sep 17 00:00:00 2001
From: m0duspwnens <josh.patterson@securityonionsolutions.com>
Date: Wed, 24 Apr 2024 16:18:45 -0400
Subject: [PATCH 1/2] allow for enabled/disable of
 so-elasticsearch-indices-delete cronjob

---
 salt/elasticsearch/defaults.yaml          |  3 ++-
 salt/elasticsearch/enabled.sls            | 13 ++++++++++---
 salt/elasticsearch/soc_elasticsearch.yaml |  4 ++++
 3 files changed, 16 insertions(+), 4 deletions(-)

diff --git a/salt/elasticsearch/defaults.yaml b/salt/elasticsearch/defaults.yaml
index 09f3bd681..53340340f 100644
--- a/salt/elasticsearch/defaults.yaml
+++ b/salt/elasticsearch/defaults.yaml
@@ -1,4 +1,6 @@
 elasticsearch:
+  enabled: false
+  index_clean: true
   config:
     action:
       destructive_requires_name: true
@@ -54,7 +56,6 @@ elasticsearch:
             enabled: true
             key: /usr/share/elasticsearch/config/elasticsearch.key
             verification_mode: none
-  enabled: false
   pipelines:
     custom001:
       description: Custom Pipeline
diff --git a/salt/elasticsearch/enabled.sls b/salt/elasticsearch/enabled.sls
index b9c66f231..1d35d3505 100644
--- a/salt/elasticsearch/enabled.sls
+++ b/salt/elasticsearch/enabled.sls
@@ -200,9 +200,15 @@ so-elasticsearch-roles-load:
     - require:
       - docker_container: so-elasticsearch
       - file: elasticsearch_sbin_jinja
-{% if grains.role in ['so-eval', 'so-standalone', 'so-managersearch', 'so-heavynode', 'so-manager'] %}
+
+{%     if grains.role in ['so-eval', 'so-standalone', 'so-managersearch', 'so-heavynode', 'so-manager'] %}
+{%       if ELASTICSEARCHMERGED.index_clean %}
+{%         set ap = "present" %}
+{%       else %}
+{%         set ap = "absent" %}
+{%       endif %}
 so-elasticsearch-indices-delete:
-  cron.present:
+  cron.{{ap}}:
     - name: /usr/sbin/so-elasticsearch-indices-delete > /opt/so/log/elasticsearch/cron-elasticsearch-indices-delete.log 2>&1
     - identifier: so-elasticsearch-indices-delete
     - user: root
@@ -211,7 +217,8 @@ so-elasticsearch-indices-delete:
     - daymonth: '*'
     - month: '*'
     - dayweek: '*'
-{% endif %}
+{%     endif %}
+
 {%   endif %}
 
 {% else %}
diff --git a/salt/elasticsearch/soc_elasticsearch.yaml b/salt/elasticsearch/soc_elasticsearch.yaml
index 7a6885075..92c759288 100644
--- a/salt/elasticsearch/soc_elasticsearch.yaml
+++ b/salt/elasticsearch/soc_elasticsearch.yaml
@@ -5,6 +5,10 @@ elasticsearch:
   esheap:
     description: Specify the memory heap size in (m)egabytes for Elasticsearch.
     helpLink: elasticsearch.html
+  index_clean:
+    description: Enable or disable so-elasticsearch-indices-delete cron job.
+    forcedType: bool
+    helpLink: elasticsearch.html
   retention: 
     retention_pct:
       decription: Total percentage of space used by Elasticsearch for multi node clusters

From d50de804a8c756e79c9fef6b4cd8094e41c2df6f Mon Sep 17 00:00:00 2001
From: m0duspwnens <josh.patterson@securityonionsolutions.com>
Date: Thu, 25 Apr 2024 09:04:34 -0400
Subject: [PATCH 2/2] update annotation

---
 salt/elasticsearch/soc_elasticsearch.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/salt/elasticsearch/soc_elasticsearch.yaml b/salt/elasticsearch/soc_elasticsearch.yaml
index 92c759288..210697bba 100644
--- a/salt/elasticsearch/soc_elasticsearch.yaml
+++ b/salt/elasticsearch/soc_elasticsearch.yaml
@@ -6,7 +6,7 @@ elasticsearch:
     description: Specify the memory heap size in (m)egabytes for Elasticsearch.
     helpLink: elasticsearch.html
   index_clean:
-    description: Enable or disable so-elasticsearch-indices-delete cron job.
+    description: Determines if indices should be considered for deletion by available disk space in the cluster. Otherwise, indices will only be deleted by the age defined in the ILM settings.
     forcedType: bool
     helpLink: elasticsearch.html
   retention: