From 2ecac38f6d4aba6c5e1cc5bd31ef48209a098a80 Mon Sep 17 00:00:00 2001
From: m0duspwnens <josh.patterson@securityonionsolutions.com>
Date: Tue, 11 Jun 2024 13:50:29 -0400
Subject: [PATCH] disable logstash on heavynodes

---
 salt/manager/tools/sbin/so-minion |  1 -
 salt/manager/tools/sbin/soup      | 17 ++++++++++++++++-
 2 files changed, 16 insertions(+), 2 deletions(-)

diff --git a/salt/manager/tools/sbin/so-minion b/salt/manager/tools/sbin/so-minion
index da1a6d2a2..bdcf4a08d 100755
--- a/salt/manager/tools/sbin/so-minion
+++ b/salt/manager/tools/sbin/so-minion
@@ -528,7 +528,6 @@ function createHEAVYNODE() {
 	pcapspace
 	add_elasticsearch_to_minion
 	add_elastic_agent_to_minion
-	add_logstash_to_minion
 	add_sensor_to_minion
 	add_strelka_to_minion
 	add_redis_to_minion
diff --git a/salt/manager/tools/sbin/soup b/salt/manager/tools/sbin/soup
index 9ee4058f9..61246c29a 100755
--- a/salt/manager/tools/sbin/soup
+++ b/salt/manager/tools/sbin/soup
@@ -308,6 +308,21 @@ clone_to_tmp() {
   fi
 }
 
+disable_logstash_heavynodes() {
+  c=0
+  printf "\nChecking for heavynodes and disabling Logstash if they exist\n"
+  for file in /opt/so/saltstack/local/pillar/minions/*.sls; do
+    if [[ $file =~ "_heavynode.sls" && ! $file =~ "/opt/so/saltstack/local/pillar/minions/adv_" ]]; then
+      if [ $c -eq 0 ]; then
+        ((c++))
+        FINAL_MESSAGE_QUEUE+=("Logstash has been disabled on all heavynodes. It can be re-enabled via Grid Configuration in SOC.")
+      fi
+      echo "Disabling Logstash for: $file"
+      so-yaml.py replace "$file" logstash.enabled False
+    fi
+  done
+}
+
 enable_highstate() {
     echo "Enabling highstate."
     salt-call state.enable highstate -l info --local
@@ -477,7 +492,7 @@ post_to_2.4.70() {
 }
 
 post_to_2.4.80() {
-  echo "Nothing to apply"
+  disable_logstash_heavynodes
   POSTVERSION=2.4.80
 }