From e3900606dc3c3fe3a83892f448cb96dab75d35ab Mon Sep 17 00:00:00 2001
From: Mike Reeves <luke@geekempire.com>
Date: Sat, 4 Sep 2021 10:42:18 -0400
Subject: [PATCH] Enable index sorting by default but allow it to be disabled

---
 salt/elasticsearch/templates/so/so-common-template.json | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/salt/elasticsearch/templates/so/so-common-template.json b/salt/elasticsearch/templates/so/so-common-template.json
index c9772b5db..4394ebb65 100644
--- a/salt/elasticsearch/templates/so/so-common-template.json
+++ b/salt/elasticsearch/templates/so/so-common-template.json
@@ -1,3 +1,4 @@
+{%- set INDEX_SORTING = salt['pillar.get']('elasticsearch:index_sorting', True) %}
 {
   "index_patterns": ["so-*"],
   "version":50001,
@@ -8,8 +9,10 @@
     "index.refresh_interval":"30s",
     "index.routing.allocation.require.box_type":"hot",
     "index.mapping.total_fields.limit": "1500",
+{%- if INDEX_SORTING is sameas true %}
     "index.sort.field": "@timestamp",
     "index.sort.order": "desc",
+{%- endif %}
     "analysis": {
       "analyzer": {
         "es_security_analyzer": {