From f80b70e008616aa7dd538965eba04470f971fc6e Mon Sep 17 00:00:00 2001
From: Wes Lambert <wlambertts@gmail.com>
Date: Tue, 9 Nov 2021 20:07:53 +0000
Subject: [PATCH 1/2] Add config for dynamically formatted ingest pipelines

---
 .../files/{ingest => ingest-dynamic}/common         | 13 +++++++++++++
 salt/elasticsearch/init.sls                         |  8 ++++++++
 2 files changed, 21 insertions(+)
 rename salt/elasticsearch/files/{ingest => ingest-dynamic}/common (94%)

diff --git a/salt/elasticsearch/files/ingest/common b/salt/elasticsearch/files/ingest-dynamic/common
similarity index 94%
rename from salt/elasticsearch/files/ingest/common
rename to salt/elasticsearch/files/ingest-dynamic/common
index 20a9d7f7e..bdf6513fe 100644
--- a/salt/elasticsearch/files/ingest/common
+++ b/salt/elasticsearch/files/ingest-dynamic/common
@@ -1,3 +1,5 @@
+{%- set HIGHLANDER = salt['pillar.get']('global:highlander', False) -%}
+{%- raw -%}
 {
   "description" : "common",
   "processors" : [
@@ -65,5 +67,16 @@
                 "index_name_format": "yyyy.MM.dd"
         }
     }
+{%- endraw %}
+{%- if HIGHLANDER %}
+    ,
+    {
+      "pipeline": {
+        "name": "ecs"
+      }
+    }
+{%- endif %}
+{%- raw %} 
   ]
 }
+{% endraw %}
diff --git a/salt/elasticsearch/init.sls b/salt/elasticsearch/init.sls
index 41a9f4504..44ffd272f 100644
--- a/salt/elasticsearch/init.sls
+++ b/salt/elasticsearch/init.sls
@@ -131,6 +131,14 @@ esrolesdir:
     - group: 939
     - makedirs: True
 
+esingestdynamicconf:
+  file.recurse:
+    - name: /opt/so/conf/elasticsearch/ingest
+    - source: salt://elasticsearch/files/ingest-dynamic
+    - user: 930
+    - group: 939
+    - template: jinja
+
 esingestconf:
   file.recurse:
     - name: /opt/so/conf/elasticsearch/ingest

From 9301b8f5b9c1834e30de8b95407df5fcb2b296c2 Mon Sep 17 00:00:00 2001
From: weslambert <wlambertts@gmail.com>
Date: Tue, 9 Nov 2021 15:56:52 -0500
Subject: [PATCH 2/2] Add dynamic conf to config change check

---
 salt/elasticsearch/init.sls | 1 +
 1 file changed, 1 insertion(+)

diff --git a/salt/elasticsearch/init.sls b/salt/elasticsearch/init.sls
index 44ffd272f..3c57aa150 100644
--- a/salt/elasticsearch/init.sls
+++ b/salt/elasticsearch/init.sls
@@ -329,6 +329,7 @@ so-elasticsearch-pipelines:
    - name: /opt/so/conf/elasticsearch/so-elasticsearch-pipelines {{ esclustername }}
    - onchanges:
       - file: esingestconf
+      - file: esingestdynamicconf
       - file: esyml
       - file: so-elasticsearch-pipelines-file