From 61ebedc0e9439c43c57c4ae8f2fff118984f16e6 Mon Sep 17 00:00:00 2001
From: Mike Reeves <mike.reeves@securityonionsolutions.com>
Date: Tue, 31 Aug 2021 16:56:08 -0400
Subject: [PATCH] Only enable curator on Manager in true cluster

---
 salt/curator/files/action/so-infoblox-warm.yml | 4 ++--
 salt/curator/files/action/so-kibana-close.yml  | 6 +++---
 salt/curator/init.sls                          | 4 ++--
 3 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/salt/curator/files/action/so-infoblox-warm.yml b/salt/curator/files/action/so-infoblox-warm.yml
index 5369ed9a9..a2f571b7a 100644
--- a/salt/curator/files/action/so-infoblox-warm.yml
+++ b/salt/curator/files/action/so-infoblox-warm.yml
@@ -1,4 +1,4 @@
-{%- set WARM_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-aws:warm', 7) -%}
+{%- set WARM_DAYS = salt['pillar.get']('elasticsearch:index_settings:so-infoblox:warm', 7) -%}
 actions:
   1:
     action: allocation
@@ -14,7 +14,7 @@ actions:
     filters:
     - filtertype: pattern
       kind: prefix
-      value: so-aws
+      value: so-infoblox
     - filtertype: age
       source: name
       direction: older
diff --git a/salt/curator/files/action/so-kibana-close.yml b/salt/curator/files/action/so-kibana-close.yml
index 05583d853..7347fb01c 100644
--- a/salt/curator/files/action/so-kibana-close.yml
+++ b/salt/curator/files/action/so-kibana-close.yml
@@ -1,4 +1,4 @@
-{%- set cur_close_days = salt['pillar.get']('elasticsearch:index_settings:so-ids:close', 30) -%}
+{%- set cur_close_days = salt['pillar.get']('elasticsearch:index_settings:so-kibana:close', 30) -%}
 ---
 # Remember, leave a key empty if there is no value.  None will be a string,
 # not a Python "NoneType"
@@ -10,7 +10,7 @@ actions:
   1:
     action: close
     description: >-
-      Close IDS indices older than {{cur_close_days}} days.
+      Close kibana indices older than {{cur_close_days}} days.
     options:
       delete_aliases: False
       timeout_override:
@@ -19,7 +19,7 @@ actions:
     filters:
     - filtertype: pattern
       kind: regex 
-      value: '^(logstash-ids.*|so-ids.*)$'
+      value: '^(logstash-kibana.*|so-kibana.*)$'
     - filtertype: age
       source: name
       direction: older
diff --git a/salt/curator/init.sls b/salt/curator/init.sls
index 54fcff3a6..87e1fec33 100644
--- a/salt/curator/init.sls
+++ b/salt/curator/init.sls
@@ -207,7 +207,7 @@ so-curatorclusterclose:
 
 so-curatorclusterdelete:
   cron.present:
-    - name: /usr/sbin/so-curator-cluster-delete > /opt/so/log/curator/cron-close.log 2>&1
+    - name: /usr/sbin/so-curator-cluster-delete > /opt/so/log/curator/cron-delete.log 2>&1
     - user: root
     - minute: '2'
     - hour: '*/1'
@@ -217,7 +217,7 @@ so-curatorclusterdelete:
         {% if HOTWARM is sameas true %}
 so-curatorclusterwarm:
   cron.present:
-    - name: /usr/sbin/so-curator-cluster-warm > /opt/so/log/curator/cron-close.log 2>&1
+    - name: /usr/sbin/so-curator-cluster-warm > /opt/so/log/curator/cron-warm.log 2>&1
     - user: root
     - minute: '2'
     - hour: '*/1'