From 822165f1682c6cca0fc7fac52589060f3f7ac981 Mon Sep 17 00:00:00 2001 From: Doug Burks Date: Tue, 29 Jun 2021 13:32:02 -0400 Subject: [PATCH 1/2] Move salt lines after shebang --- salt/common/tools/sbin/so-filebeat-module-setup | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/salt/common/tools/sbin/so-filebeat-module-setup b/salt/common/tools/sbin/so-filebeat-module-setup index ef35a9b17..401f54289 100755 --- a/salt/common/tools/sbin/so-filebeat-module-setup +++ b/salt/common/tools/sbin/so-filebeat-module-setup @@ -1,6 +1,3 @@ -{%- set mainint = salt['pillar.get']('host:mainint') %} -{%- set MYIP = salt['grains.get']('ip_interfaces:' ~ mainint)[0] %} - #!/bin/bash # Copyright 2014,2015,2016,2017,2018,2019,2020,2021 Security Onion Solutions, LLC # @@ -17,6 +14,9 @@ # You should have received a copy of the GNU General Public License # along with this program. If not, see . +{%- set mainint = salt['pillar.get']('host:mainint') %} +{%- set MYIP = salt['grains.get']('ip_interfaces:' ~ mainint)[0] %} + default_conf_dir=/opt/so/conf ELASTICSEARCH_HOST="{{ MYIP }}" ELASTICSEARCH_PORT=9200 From dac19d224f405b24d1165a124070a86b97a39a95 Mon Sep 17 00:00:00 2001 From: m0duspwnens Date: Tue, 29 Jun 2021 17:15:00 -0400 Subject: [PATCH 2/2] update cq --- salt/influxdb/init.sls | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/salt/influxdb/init.sls b/salt/influxdb/init.sls index 37ebe39a5..f270c9f73 100644 --- a/salt/influxdb/init.sls +++ b/salt/influxdb/init.sls @@ -118,7 +118,7 @@ so_downsample_{{measurement}}_cq: influxdb_continuous_query.present: - name: so_downsample_{{measurement}}_cq - database: telegraf - - query: SELECT mean(*) INTO "{{dest_rp}}"."{{measurement}}" FROM "{{measurement}}" GROUP BY time({{influxdb.downsample[dest_rp].resolution}}) + - query: SELECT mean(*) INTO "{{dest_rp}}"."{{measurement}}" FROM "{{measurement}}" GROUP BY time({{influxdb.downsample[dest_rp].resolution}}),* - ssl: True - verify_ssl: /etc/pki/ca.crt - cert: ['/etc/pki/influxdb.crt', '/etc/pki/influxdb.key']