From 1396083b7da0804c061176e0f32236115cadd1c0 Mon Sep 17 00:00:00 2001
From: reyesj2 <94730068+reyesj2@users.noreply.github.com>
Date: Fri, 17 Jan 2025 13:29:46 -0600
Subject: [PATCH] use so-elasticsearch-query where possible; simplify
 suricata.alerts index reroute

Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>
---
 salt/elasticsearch/files/ingest/suricata.alert | 2 +-
 salt/manager/tools/sbin/soup                   | 5 ++---
 2 files changed, 3 insertions(+), 4 deletions(-)

diff --git a/salt/elasticsearch/files/ingest/suricata.alert b/salt/elasticsearch/files/ingest/suricata.alert
index 9ee0acfd6..9dd97e190 100644
--- a/salt/elasticsearch/files/ingest/suricata.alert
+++ b/salt/elasticsearch/files/ingest/suricata.alert
@@ -1,7 +1,7 @@
 {
   "description" : "suricata.alert",
   "processors" : [
-    { "set":   { "if": "ctx.event?.imported != null && ctx.event?.imported != true", "field": "_index", "value": "logs-suricata.alerts-so" } },
+    { "set":   { "if": "ctx.event?.imported != true", "field": "_index", "value": "logs-suricata.alerts-so" } },
     { "set":   { "field": "tags","value": "alert" }},
     { "rename":{ "field": "message2.alert",	"target_field": "rule",	"ignore_failure": true 	} },
     { "rename":{ "field": "rule.signature",     "target_field": "rule.name", "ignore_failure": true  } },
diff --git a/salt/manager/tools/sbin/soup b/salt/manager/tools/sbin/soup
index 5e52388ac..88dd5c9d8 100755
--- a/salt/manager/tools/sbin/soup
+++ b/salt/manager/tools/sbin/soup
@@ -812,10 +812,9 @@ ASSIST_EOF
 
 rollover_index() {
   idx=$1
-  exists=$(curl -K /opt/so/conf/elasticsearch/curl.config -s -o /dev/null -w "%{http_code}" -k -L -H "Content-Type: application/json" "https://localhost:9200/$idx")
-
+  exists=$(so-elasticsearch-query $idx -o /dev/null -w "%{http_code}")
   if [[ $exists -eq 200 ]]; then
-    rollover=$(curl -K /opt/so/conf/elasticsearch/curl.config -s -o /dev/null -w "%{http_code}" -k -L -H "Content-Type: application/json" "https://localhost:9200/$idx/_rollover" -XPOST)
+    rollover=$(so-elasticsearch-query $idx/_rollover -o /dev/null -w "%{http_code}" -XPOST)
 
     if [[ $rollover -eq 200 ]]; then
       echo "Successfully triggered rollover for $idx..."