Add logrotate

salt/logrotate/defaults.yaml

@@ -90,7 +90,7 @@ logrotate:
       - extension .log
       - dateext
       - dateyesterday
-    /opt/so/log/fleet/*_x_log:
+    /opt/so/log/elasticfleet/*_x_log:
       - daily
       - rotate 14
       - missingok
@@ -100,6 +100,16 @@ logrotate:
       - extension .log
       - dateext
       - dateyesterday
+    /opt/so/log/elasticfleet/*_x_ndjson:
+      - daily
+      - rotate 14
+      - missingok
+      - copytruncate
+      - compress
+      - create
+      - extension .ndjson
+      - dateext
+      - dateyesterday
     /opt/so/log/suricata/*_x_log:
       - daily
       - rotate 14

salt/logrotate/soc_logrotate.yaml

@@ -63,9 +63,16 @@ logrotate:
       multiline: True
       global: True
       forcedType: "[]string"
-    "/opt/so/log/fleet/*_x_log":
+    "/opt/so/log/elasticfleet/*_x_log":
       description: List of logrotate options for this file.
-      title: /opt/so/log/fleet/*.log
+      title: /opt/so/log/elastic-fleet/*.log
+      advanced: True
+      multiline: True
+      global: True
+      forcedType: "[]string"
+    "/opt/so/log/elasticfleet/*_x_ndjson":
+      description: List of logrotate options for this file.
+      title: /opt/so/log/elastic-fleet/*.ndjson
       advanced: True
       multiline: True
       global: True