From 2472d6a7279e025e6714925dac83bb7c9f9eca42 Mon Sep 17 00:00:00 2001
From: Josh Brower <josh@defensivedepth.com>
Date: Thu, 3 Aug 2023 18:52:29 -0400
Subject: [PATCH] Don't watch certs on search nodes

---
 salt/logstash/enabled.sls | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/salt/logstash/enabled.sls b/salt/logstash/enabled.sls
index a33080f8d..731ad4ca3 100644
--- a/salt/logstash/enabled.sls
+++ b/salt/logstash/enabled.sls
@@ -91,8 +91,10 @@ so-logstash:
         {% endfor %}
       {% endif %}
     - watch:
+      {% if grains['role'] in ['so-manager', 'so-eval', 'so-managersearch', 'so-standalone', 'so-import', 'so-fleet', 'so-receiver'] %}
       - x509: etc_elasticfleet_logstash_key
       - x509: etc_elasticfleet_logstash_crt
+      {% endif %}
       - file: lsetcsync
       {% for assigned_pipeline in LOGSTASH_MERGED.assigned_pipelines.roles[GLOBALS.role.split('-')[1]] %}
       - file: ls_pipeline_{{assigned_pipeline}}