Fix the features suffix

salt/common/tools/sbin/so-image-common

@@ -49,13 +49,17 @@ container_list() {
       "so-curator"
       "so-domainstats"
       "so-elastalert"
+      "so-elasticsearch"
+      "so-filebeat"
       "so-fleet"
       "so-fleet-launcher"
       "so-freqserver"
       "so-grafana"
       "so-idstools"
       "so-influxdb"
+      "so-kibana"
       "so-kratos"
+      "so-logstash"
       "so-minio"
       "so-mysql"
       "so-nginx"
@@ -77,21 +81,6 @@ container_list() {
       "so-wazuh"
       "so-zeek" 
     )
-    if [[ "$FEATURESCHECK" == "True" ]]; then
-      TRUSTED_CONTAINERS=( "${TRUSTED_CONTAINERS[@]}"
-        "so-elasticsearch-features"
-        "so-filebeat-features"
-        "so-logstash-features"
-        "so-kibana-features"
-      )
-    else
-      TRUSTED_CONTAINERS=( "${TRUSTED_CONTAINERS[@]}"
-        "so-elasticsearch"
-        "so-filebeat"
-        "so-logstash"
-        "so-kibana"
-      )
-    fi
   else
     TRUSTED_CONTAINERS=(
       "so-filebeat"

salt/common/tools/sbin/soup

@@ -467,6 +467,12 @@ else
   rm -rf $UPDATE_DIR
   clone_to_tmp
 fi
+
+echo ""
+echo "Verifying we have the latest soup script."
+verify_latest_update_script
+echo ""
+
 echo "Generating new repo archive"
 generate_and_clean_tarballs
 if [ -f /usr/sbin/so-image-common ]; then
@@ -475,11 +481,6 @@ else
 add_common
 fi
 
-echo ""
-echo "Verifying we have the latest soup script."
-verify_latest_update_script
-echo ""
-
 echo "Let's see if we need to update Security Onion."
 upgrade_check
 space_check
@@ -496,6 +497,15 @@ if [ $is_airgap -eq 0 ]; then
 else
   update_registry
   update_docker_containers "soup"
+  FEATURESCHECK=$(lookup_pillar features elastic)
+  if [[ "$FEATURESCHECK" == "True" ]]; then 
+    TRUSTED_CONTAINERS=( \
+      "so-elasticsearch" \
+      "so-filebeat" \
+      "so-kibana" \
+      "so-logstash" )
+    update_docker_containers "features" "-features"
+  fi
 fi
 echo ""
 echo "Stopping Salt Minion service."