From 55a8f6aa7aea1d2b2925b185b10c4f121e1239d7 Mon Sep 17 00:00:00 2001
From: Mike Reeves <mike.reeves@securityonionsolutions.com>
Date: Tue, 2 Feb 2021 16:41:52 -0500
Subject: [PATCH] Make filebeat retry forever

---
 salt/filebeat/etc/filebeat.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/salt/filebeat/etc/filebeat.yml b/salt/filebeat/etc/filebeat.yml
index 1b902d542..931d38b28 100644
--- a/salt/filebeat/etc/filebeat.yml
+++ b/salt/filebeat/etc/filebeat.yml
@@ -440,7 +440,7 @@ setup.template.enabled: false
   # The number of times a particular Elasticsearch index operation is attempted. If
   # the indexing operation doesn't succeed after this many retries, the events are
   # dropped. The default is 3.
-  #max_retries: 3
+  max_retries: -1
 
   # The maximum number of events to bulk in a single Elasticsearch bulk API index request.
   # The default is 50.