Merge pull request #8296 from Security-Onion-Solutions/elastalert_esversion_check

use onlyif requisite instead
This commit is contained in:
Josh Patterson
2022-07-13 15:22:40 -04:00
committed by GitHub

View File

@@ -107,10 +107,6 @@ wait_for_elasticsearch:
cmd.run:
- name: so-elasticsearch-wait
is_elasticsearch_v8:
cmd.shell:
- name: "so-elasticsearch-query / | jq -r '.version.number[0:1]' | grep -q 8" #if not 8 do not start ES
so-elastalert:
docker_container.running:
- image: {{ MANAGER }}:5000/{{ IMAGEREPO }}/so-elastalert:{{ VERSION }}
@@ -127,13 +123,15 @@ so-elastalert:
- {{MANAGER_URL}}:{{MANAGER_IP}}
- require:
- cmd: wait_for_elasticsearch
- cmd: is_elasticsearch_v8
- file: elastarules
- file: elastalogdir
- file: elastacustmodulesdir
- file: elastaconf
- watch:
- file: elastaconf
- onlyif:
- "so-elasticsearch-query / | jq -r '.version.number[0:1]' | grep -q 8" {# only run this state if elasticsearch is version 8 #}
append_so-elastalert_so-status.conf:
file.append: