From 81ac1ebc08382d4a55b21a7066cc17be48c9308e Mon Sep 17 00:00:00 2001
From: reyesj2 <94730068+reyesj2@users.noreply.github.com>
Date: Wed, 22 Jan 2025 13:12:09 -0600
Subject: [PATCH] fixes merging local pillar /global overrides for generated
 index templates

---
 salt/elasticfleet/integration-defaults.map.jinja | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/salt/elasticfleet/integration-defaults.map.jinja b/salt/elasticfleet/integration-defaults.map.jinja
index 09710a43c..30eda7081 100644
--- a/salt/elasticfleet/integration-defaults.map.jinja
+++ b/salt/elasticfleet/integration-defaults.map.jinja
@@ -67,7 +67,10 @@
 {%           if component_name in WEIRD_INTEGRATIONS %}
 {%             set component_name = WEIRD_INTEGRATIONS[component_name] %}
 {%           endif %}
-{%           set integration_key = "so-" ~ integration_type ~ component_name %}
+{#           component_name_x maintains the functionality of merging local pillar changes with generated 'defaults' via SOC UI #}
+{%           set component_name_x = component_name.replace(".","_x_") %}
+{#           pillar overrides/merge expects the key names to follow the naming in elasticsearch/defaults.yaml eg. so-logs-1password_x_item_usages . The _x_ is replaced later on in elasticsearch/template.map.jinja #}
+{%           set integration_key = "so-" ~ integration_type ~ component_name_x %}
 
 {#           Default integration settings #}
 {%           set integration_defaults = {