https://github.com/Security-Onion-Solutions/securityonion/issues/404

salt/telegraf/etc/telegraf.conf

@@ -13,7 +13,7 @@
 # them with $. For strings the variable must be within quotes (ie, "$STR_VAR"),
 # for numbers and booleans they should be plain (ie, $INT_VAR, $BOOL_VAR)
 
-{%- set MASTER = grains['master'] %}
+{%- set MANAGER = grains['manager'] %}
 {% set NODEIP = salt['pillar.get']('elasticsearch:mainip', '') %}
 {% set HELIX_API_KEY = salt['pillar.get']('fireeye:helix:api_key', '') %}
 {% set UNIQUEID = salt['pillar.get']('sensor:uniqueid', '') %}
@@ -98,7 +98,7 @@
   ## urls will be written to each interval.
   # urls = ["unix:///var/run/influxdb.sock"]
   # urls = ["udp://127.0.0.1:8089"]
-  urls = ["https://{{ MASTER }}:8086"]
+  urls = ["https://{{ MANAGER }}:8086"]
 
 
   ## The target database for metrics; will be created as needed.
@@ -616,13 +616,13 @@
 
 
 # # Read stats from one or more Elasticsearch servers or clusters
-{% if grains['role'] in ['so-master', 'so-eval', 'so-mastersearch', 'so-standalone']   %}
+{% if grains['role'] in ['so-manager', 'so-eval', 'so-managersearch', 'so-standalone']   %}
  [[inputs.elasticsearch]]
 
 #   ## specify a list of one or more Elasticsearch servers
 #   # you can add username and password to your url to use basic authentication:
 #   # servers = ["http://user:pass@localhost:9200"]
-   servers = ["http://{{ MASTER }}:9200"]
+   servers = ["http://{{ MANAGER }}:9200"]
 {% elif grains['role'] in ['so-node', 'so-hotnode', 'so-warmnode', 'so-heavynode']  %}
  [[inputs.elasticsearch]]
    servers = ["http://{{ NODEIP }}:9200"]
@@ -666,7 +666,7 @@
 # # Read metrics from one or more commands that can output to stdout
 
 #   ## Commands array
-{% if grains['role'] in ['so-master', 'so-mastersearch'] %}
+{% if grains['role'] in ['so-manager', 'so-managersearch'] %}
 [[inputs.exec]]
    commands = [
      "/scripts/redis.sh",