From 522bc1d2b84bcddc5bca7641b4e267b3544e249f Mon Sep 17 00:00:00 2001
From: m0duspwnens <josh.patterson@securityonionsolutions.com>
Date: Wed, 15 Dec 2021 16:21:08 -0500
Subject: [PATCH] fix loadbalance logic and whitespace for filebeat.yml

---
 salt/filebeat/etc/filebeat.yml | 35 ++++++++++++++++++----------------
 1 file changed, 19 insertions(+), 16 deletions(-)

diff --git a/salt/filebeat/etc/filebeat.yml b/salt/filebeat/etc/filebeat.yml
index 05605b96d..a0f973053 100644
--- a/salt/filebeat/etc/filebeat.yml
+++ b/salt/filebeat/etc/filebeat.yml
@@ -322,24 +322,27 @@ output.logstash:
 
   # The Logstash hosts
   hosts:
-{%- if grains.role in ['so-sensor', 'so-fleet', 'so-node'] %}
-{%-   set LOADBALANCE = ['false'] %}
-{%-   set node_data = salt['pillar.get']('logstash:nodes') %}
-{%-   for node_type, node_details in node_data.items() | sort %}
-{%-     if node_type in ['manager', 'managersearch', 'standalone', 'receiver' ] %}
-{%-       for hostname in node_data[node_type].keys() %}
+{%- if grains.role in ['so-sensor', 'so-fleet', 'so-node'] -%}
+{%   set LOGSTASH = namespace() -%}
+{%   set LOGSTASH.count = 0 -%}
+{%   set LOGSTASH.loadbalance = false -%}
+{%   set node_data = salt['pillar.get']('logstash:nodes') -%}
+{%   for node_type, node_details in node_data.items() | sort -%}
+{%     if node_type in ['manager', 'managersearch', 'standalone', 'receiver' ] -%}
+{%       for hostname in node_data[node_type].keys() -%}
+{%         set LOGSTASH.count = LOGSTASH.count + 1 %}
     - "{{ hostname }}:5644" #{{ node_details[hostname].ip }}
-{%-       endfor %}
-{%-     endif %}
-{%-     if loop.index == 2 %}
-{%-       do LOADBALANCE.insert(0, 'true') %}
-{%-     endif %}
-{%-   endfor %}
-  loadbalance: {{ LOADBALANCE[0] }}
-{%- else %}
-    - "{{ grains.host }}:5644"
-{%- endif %}
+{%-       endfor -%}
+{%     endif -%}
+{%     if LOGSTASH.count > 1 -%}
+{%       set LOGSTASH.loadbalance = true -%}
+{%     endif -%}
+{%   endfor %}
 
+  loadbalance: {{ LOGSTASH.loadbalance | lower }}
+{% else -%}
+    - "{{ grains.host }}:5644"
+{% endif %}
   # Number of workers per Logstash host.
   worker: {{ FBLSWORKERS }}