From 473f93f0ee20e2c307455b9c5e639a044d448927 Mon Sep 17 00:00:00 2001
From: reyesj2 <94730068+reyesj2@users.noreply.github.com>
Date: Wed, 27 May 2026 09:33:15 -0500
Subject: [PATCH] check for stale logstash pipeline name in pillars

---
 salt/manager/tools/sbin/soup | 18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

diff --git a/salt/manager/tools/sbin/soup b/salt/manager/tools/sbin/soup
index 46785be3c..58cbbac43 100755
--- a/salt/manager/tools/sbin/soup
+++ b/salt/manager/tools/sbin/soup
@@ -1506,7 +1506,23 @@ EOF
 
 # Keeping this block in case we need to do a hotfix that requires salt update
 apply_hotfix() {
-   echo "No actions required. ($INSTALLEDVERSION/$HOTFIXVERSION)"
+    if [[ "$INSTALLEDVERSION" == "3.1.0" ]] ; then
+        echo "Checking for conflicting logstash defined_pipelines pillar value."
+        local LOGSTASH_FILE=/opt/so/saltstack/local/pillar/logstash/soc_logstash.sls
+        local MINIONDIR=/opt/so/saltstack/local/pillar/minions
+
+        for pillar_file in "$LOGSTASH_FILE" "$MINIONDIR"/*.sls; do
+            [[ -f "$pillar_file" ]] || continue
+            if grep -q 'so/0013_input_lumberjack_fleet.conf$' "$pillar_file"; then
+                echo "Found conflicting defined_pipeline pillar value in $pillar_file. Updating to use the new logstash pipeline name."
+                sed -i 's#so/0013_input_lumberjack_fleet\.conf$#so/0013_input_lumberjack_fleet.conf.jinja#g' "$pillar_file"
+                chown socore:socore "$pillar_file"
+            fi
+
+        done
+    else
+        echo "No actions required. ($INSTALLEDVERSION/$HOTFIXVERSION)"
+    fi
 }
 
 failed_soup_restore_items() {