https://github.com/Security-Onion-Solutions/securityonion/issues/6811

salt/manager/elasticsearch.sls

@@ -0,0 +1,8 @@
+
+elastic_curl_config_distributed:
+  file.managed:
+    - name: /opt/so/saltstack/local/salt/elasticsearch/curl.config
+    - source: salt://elasticsearch/files/curl.config.template
+    - template: jinja
+    - mode: 600
+    - show_changes: False

salt/manager/init.sls

@@ -25,6 +25,7 @@ include:
   - kibana.secrets
   - salt.minion
   - kratos
+  - manager.elasticsearch
 
 socore_own_saltstack:
   file.directory:
@@ -110,14 +111,6 @@ strelka_yara_update:
     - hour: '7'
     - minute: '1'
 
-elastic_curl_config_distributed:
-  file.managed:
-    - name: /opt/so/saltstack/local/salt/elasticsearch/curl.config
-    - source: salt://elasticsearch/files/curl.config.template
-    - template: jinja
-    - mode: 600
-    - show_changes: False
-
 # Must run before elasticsearch docker container is started!
 syncesusers:
   cmd.run: