Merge pull request #5905 from Security-Onion-Solutions/feature/soc_es_index_pattern

Allow setting ES index patterns for SOC in pillar

salt/soc/files/soc/soc.json

@@ -26,7 +26,7 @@
 {%-   set ES_USER = '' %}
 {%-   set ES_PASS = '' %}
 {%- endif %}
-
+{%- set ES_INDEX_PATTERNS = salt['pillar.get']('soc:es_index_patterns', '*:so-*') %}
 {
   "logFilename": "/opt/sensoroni/logs/sensoroni-server.log",
   "server": {
@@ -57,6 +57,7 @@
         {%- endif %}
         "username": "{{ ES_USER }}",
         "password": "{{ ES_PASS }}",
+	"index": "{{ ES_INDEX_PATTERNS }}",
         "cacheMs": {{ ES_FIELDCAPS_CACHE }},
         "verifyCert": false,
         "timeoutMs": {{ API_TIMEOUT }}

setup/so-functions

@@ -1645,6 +1645,7 @@ manager_pillar() {
         	printf '%s\n'\
 			"soc:"\
                 	"  endgamehost: '$ENDGAMEHOST'"\
+			"  es_index_patterns: '*:so-*, *:endgame-*'"\
                 	"" >> "$pillar_file"
 	fi
 }