From df95baa8354c3e9b306238e5c1646f0009045310 Mon Sep 17 00:00:00 2001
From: Mike Reeves <mike.reeves@securityonionsolutions.com>
Date: Thu, 20 Aug 2020 10:45:48 -0400
Subject: [PATCH] Point logstash to use intca.crt

---
 salt/logstash/init.sls | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/salt/logstash/init.sls b/salt/logstash/init.sls
index c82383375..33fc496dc 100644
--- a/salt/logstash/init.sls
+++ b/salt/logstash/init.sls
@@ -168,7 +168,11 @@ so-logstash:
       - /sys/fs/cgroup:/sys/fs/cgroup:ro
       - /etc/pki/filebeat.crt:/usr/share/logstash/filebeat.crt:ro
       - /etc/pki/filebeat.p8:/usr/share/logstash/filebeat.key:ro
+      {% if grains['role'] == 'so-heavynode' %}
+      - /etc/ssl/certs/intca.crt:/usr/share/filebeat/ca.crt:ro
+      {% else %}
       - /etc/pki/ca.crt:/usr/share/filebeat/ca.crt:ro
+      {% endif %}
       - /opt/so/conf/ca/cacerts:/etc/pki/ca-trust/extracted/java/cacerts:ro
       - /opt/so/conf/ca/tls-ca-bundle.pem:/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem:ro
       - /etc/pki/ca.cer:/ca/ca.crt:ro