From 721b1d62071ce13210e2e609226bbedd53f30361 Mon Sep 17 00:00:00 2001
From: reyesj2 <94730068+reyesj2@users.noreply.github.com>
Date: Tue, 8 Sep 2026 08:30:00 -0500
Subject: [PATCH] drop remapped sentinel_one_cloud_funnel.login index template

---
 salt/common/tools/sbin/so-common | 13 +++++++++++++
 salt/manager/tools/sbin/soup     |  6 ++++++
 2 files changed, 19 insertions(+)

diff --git a/salt/common/tools/sbin/so-common b/salt/common/tools/sbin/so-common
index 402d84363..fbcd37bb9 100755
--- a/salt/common/tools/sbin/so-common
+++ b/salt/common/tools/sbin/so-common
@@ -418,6 +418,19 @@ is_single_node_grid() {
 	grep "role: so-" /etc/salt/grains | grep -E "eval|standalone|import" &> /dev/null
 }
 
+remove_elasticsearch_index_template() {
+  local template_name=$1
+  local reason=${2:-"Removing index template for upgrade"}
+
+  # check if template exists
+  if so-elasticsearch-query "_index_template/$template_name" --fail --retry 3 --retry-delay 5 >/dev/null 2>&1; then
+    echo "Removing Elasticsearch index template: $template_name ($reason)"
+    if ! so-elasticsearch-query "_index_template/$template_name" -XDELETE --fail --retry 3 --retry-delay 5; then
+      return 1
+    fi
+  fi
+}
+
 initialize_elasticsearch_indices() {
     local index_names=$1
     local default_entry=${2:-'{"@timestamp":"0"}'}
diff --git a/salt/manager/tools/sbin/soup b/salt/manager/tools/sbin/soup
index e66262ce5..353158b7e 100755
--- a/salt/manager/tools/sbin/soup
+++ b/salt/manager/tools/sbin/soup
@@ -1050,6 +1050,12 @@ post_to_3.2.0() {
 up_to_3.3.0() {
   # download 9.4.5 elastic agent packages
   determine_elastic_agent_upgrade
+  
+  # remove existing (patched) elasticsearch index template to match integration naming change
+  if ! remove_elasticsearch_index_template "so-logs-sentinel_one_cloud_funnel.login" "sentinel_one_cloud_funnel.login changed to sentinel_one_cloud_funnel.logins"; then
+    FINAL_MESSAGE_QUEUE+=("WARNING: Unable to automatically remove the so-logs-sentinel_one_cloud_funnel.login index template. This step can be performed manually using the following command:")
+    FINAL_MESSAGE_QUEUE+=("    - sudo so-elasticsearch-query _index_template/so-logs-sentinel_one_cloud_funnel.login -XDELETE && so-checkin")
+  fi
 
   INSTALLEDVERSION=3.3.0
 }