diff --git a/salt/filebeat/securityoniondefaults.yaml b/salt/filebeat/securityoniondefaults.yaml
index e6406af8c..8bcecd618 100644
--- a/salt/filebeat/securityoniondefaults.yaml
+++ b/salt/filebeat/securityoniondefaults.yaml
@@ -1,3 +1,4 @@
+{%- set ZEEKVER = salt['pillar.get']('global:mdengine', '') %}
 securityonion_filebeat:
   modules:
     elasticsearch: