Merge remote-tracking branch 'origin/2.4/dev' into salt3006.1

salt/elasticfleet/files/integrations/endpoints-initial/system-endpoints.json

@@ -1,11 +1,11 @@
 {
+  "policy_id": "endpoints-initial",
   "package": {
     "name": "system",
     "version": ""
   },
   "name": "system-endpoints",
   "namespace": "default",
-  "policy_id": "endpoints-initial",
   "inputs": {
     "system-logfile": {
       "enabled": true,
@@ -13,14 +13,9 @@
         "system.auth": {
           "enabled": true,
           "vars": {
-            "ignore_older": "72h",
             "paths": [
               "/var/log/auth.log*",
               "/var/log/secure*"
-            ],
-            "preserve_original_event": false,
-            "tags": [
-              "system-auth"
             ]
           }
         },
@@ -30,40 +25,26 @@
             "paths": [
               "/var/log/messages*",
               "/var/log/syslog*"
-            ],
-            "tags": [],
-            "ignore_older": "72h"
+            ]
           }
         }
       }
     },
     "system-winlog": {
       "enabled": true,
+      "vars": {
+        "preserve_original_event": false
+      },
       "streams": {
         "system.application": {
           "enabled": true,
           "vars": {
-            "preserve_original_event": false,
-            "ignore_older": "72h",
-            "language": 0,
             "tags": []
           }
         },
         "system.security": {
           "enabled": true,
           "vars": {
-            "preserve_original_event": false,
-            "ignore_older": "72h",
-            "language": 0,
-            "tags": []
-          }
-        },
-        "system.system": {
-          "enabled": true,
-          "vars": {
-            "preserve_original_event": false,
-            "ignore_older": "72h",
-            "language": 0,
             "tags": []
           }
         }

salt/elasticfleet/files/integrations/endpoints-initial/windows-endpoints.json

@@ -1,11 +1,12 @@
 {
+  "policy_id": "endpoints-initial",
   "package": {
     "name": "windows",
     "version": ""
   },
   "name": "windows-endpoints",
+  "description": "",
   "namespace": "default",
-  "policy_id": "endpoints-initial",
   "inputs": {
     "windows-winlog": {
       "enabled": true,
@@ -13,47 +14,54 @@
         "windows.forwarded": {
           "enabled": true,
           "vars": {
-            "preserve_original_event": false,
-            "ignore_older": "72h",
-            "language": 0,
             "tags": [
               "forwarded"
-            ]
+            ],
+            "preserve_original_event": false
           }
         },
         "windows.powershell": {
           "enabled": true,
           "vars": {
-            "preserve_original_event": false,
-            "event_id": "400, 403, 600, 800",
-            "ignore_older": "72h",
-            "language": 0,
-            "tags": []
+            "tags": [],
+            "preserve_original_event": false
           }
         },
         "windows.powershell_operational": {
           "enabled": true,
           "vars": {
-            "preserve_original_event": false,
-            "event_id": "4103, 4104, 4105, 4106",
-            "ignore_older": "72h",
-            "language": 0,
-            "tags": []
+            "tags": [],
+            "preserve_original_event": false
           }
         },
         "windows.sysmon_operational": {
           "enabled": true,
           "vars": {
-            "preserve_original_event": false,
-            "ignore_older": "72h",
-            "language": 0,
-            "tags": []
+            "tags": [],
+            "preserve_original_event": false
           }
         }
       }
     },
     "windows-windows/metrics": {
-      "enabled": false
+      "enabled": false,
+      "streams": {
+        "windows.perfmon": {
+          "enabled": false,
+          "vars": {
+            "perfmon.group_measurements_by_instance": false,
+            "perfmon.ignore_non_existent_counters": false,
+            "perfmon.queries": "- object: 'Process'\n  instance: [\"*\"]\n  counters:\n   - name: '% Processor Time'\n     field: cpu_perc\n     format: \"float\"\n   - name: \"Working Set\"\n",
+            "period": "10s"
+          }
+        },
+        "windows.service": {
+          "enabled": false,
+          "vars": {
+            "period": "60s"
+          }
+        }
+      }
     }
   }
 }

salt/elasticfleet/files/integrations/grid-nodes/system-grid-nodes.json

@@ -1,11 +1,11 @@
 {
+  "policy_id": "so-grid-nodes",
   "package": {
     "name": "system",
     "version": ""
   },
   "name": "system-grid-nodes",
   "namespace": "default",
-  "policy_id": "so-grid-nodes",
   "inputs": {
     "system-logfile": {
       "enabled": true,
@@ -13,14 +13,9 @@
         "system.auth": {
           "enabled": true,
           "vars": {
-            "ignore_older": "72h",
             "paths": [
               "/var/log/auth.log*",
               "/var/log/secure*"
-            ],
-            "preserve_original_event": false,
-            "tags": [
-              "system-auth"
             ]
           }
         },
@@ -30,9 +25,7 @@
             "paths": [
               "/var/log/messages*",
               "/var/log/syslog*"
-            ],
-            "tags": [],
-            "ignore_older": "72h"
+            ]
           }
         }
       }

salt/elasticsearch/ca.sls

@@ -17,10 +17,11 @@ catrustdir:
 
 {%   if GLOBALS.is_manager %}
 # We have to add the Manager CA to the CA list
-cascriptsync:
+catrustscript:
   cmd.script:
     - source: salt://elasticsearch/tools/sbin_jinja/so-catrust
     - template: jinja
+    - cwd: /opt/so
     - defaults:
         GLOBALS: {{ GLOBALS }}
 {%   endif %}