From 2b39570b085970545c86723acf28dfd003e0b77c Mon Sep 17 00:00:00 2001
From: Josh Brower <josh@defensivedepth.com>
Date: Mon, 18 Apr 2022 10:37:38 -0400
Subject: [PATCH 1/3] Fix matching logic

---
 salt/elasticsearch/files/log4j2.properties | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/salt/elasticsearch/files/log4j2.properties b/salt/elasticsearch/files/log4j2.properties
index 693f6d8de..014fa61a1 100644
--- a/salt/elasticsearch/files/log4j2.properties
+++ b/salt/elasticsearch/files/log4j2.properties
@@ -20,7 +20,7 @@ appender.rolling.strategy.type = DefaultRolloverStrategy
 appender.rolling.strategy.action.type = Delete
 appender.rolling.strategy.action.basepath = /var/log/elasticsearch
 appender.rolling.strategy.action.condition.type = IfFileName
-appender.rolling.strategy.action.condition.glob = *.log
+appender.rolling.strategy.action.condition.glob = *.gz
 appender.rolling.strategy.action.condition.nested_condition.type = IfLastModified
 appender.rolling.strategy.action.condition.nested_condition.age = 7D
 rootLogger.level = info

From b35b505f0ae02ef49e4f921bbb43c97b1deb1c9f Mon Sep 17 00:00:00 2001
From: Josh Brower <josh@defensivedepth.com>
Date: Mon, 18 Apr 2022 10:39:04 -0400
Subject: [PATCH 2/3] Fix pattern matching

---
 salt/logstash/etc/log4j2.properties | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/salt/logstash/etc/log4j2.properties b/salt/logstash/etc/log4j2.properties
index 30edfbbbb..739756061 100644
--- a/salt/logstash/etc/log4j2.properties
+++ b/salt/logstash/etc/log4j2.properties
@@ -27,7 +27,7 @@ appender.rolling.strategy.type = DefaultRolloverStrategy
 appender.rolling.strategy.action.type = Delete
 appender.rolling.strategy.action.basepath = /var/log/logstash
 appender.rolling.strategy.action.condition.type = IfFileName
-appender.rolling.strategy.action.condition.glob = logstash-*.log
+appender.rolling.strategy.action.condition.glob = *.gz
 appender.rolling.strategy.action.condition.nested_condition.type = IfLastModified
 appender.rolling.strategy.action.condition.nested_condition.age = 7D
 rootLogger.level = info

From 012ff3e1bc7aca3337750446f0a29edb8d9eeccb Mon Sep 17 00:00:00 2001
From: Mike Reeves <mike.reeves@securityonionsolutions.com>
Date: Mon, 18 Apr 2022 11:02:19 -0400
Subject: [PATCH 3/3] Fix Analyst Install Loop

---
 setup/so-setup    |  4 +++-
 setup/so-whiptail | 18 +++++-------------
 2 files changed, 8 insertions(+), 14 deletions(-)

diff --git a/setup/so-setup b/setup/so-setup
index 30bafc406..8bf893d8c 100755
--- a/setup/so-setup
+++ b/setup/so-setup
@@ -351,7 +351,9 @@ elif [ "$install_type" = 'RECEIVER' ]; then
 	is_minion=true
 	is_receiver=true
 elif [ "$install_type" = 'ANALYST' ]; then
-	exec bash so-setup analyst
+	if [ "$setup_type" != 'analyst' ]; then
+		exec bash so-setup analyst
+	fi
 fi
 
 if [[ $is_manager || $is_import ]]; then
diff --git a/setup/so-whiptail b/setup/so-whiptail
index 5c6129f76..289752667 100755
--- a/setup/so-whiptail
+++ b/setup/so-whiptail
@@ -934,21 +934,13 @@ whiptail_install_type_other() {
 
 	# so-analyst-install will only work with a working network connection
 	# so only show it on network installs for now
-	if [[ $setup_type == 'network' ]]; then
-		install_type=$(whiptail --title "$whiptail_title" --radiolist \
+	install_type=$(whiptail --title "$whiptail_title" --radiolist \
 		"Choose node type:" 9 65 2 \
-			"ANALYST" "Setup will run 'so-setup analyst' " ON \
-			"HELIXSENSOR" "Create a Helix sensor " OFF \
-			3>&1 1>&2 2>&3
+		"ANALYST" "Setup will run 'so-setup analyst' " ON \
+		"HELIXSENSOR" "Create a Helix sensor " OFF \
+		3>&1 1>&2 2>&3
 		)
-	else
-		install_type=$(whiptail --title "$whiptail_title" --radiolist \
-		"Choose node type:" 8 65 1 \
-			"HELIXSENSOR" "Create a Helix sensor " ON \
-			3>&1 1>&2 2>&3
-		)
-	fi
-
+	
 	local exitstatus=$?
 	whiptail_check_exitstatus $exitstatus