diff --git a/salt/common/tools/sbin/soup b/salt/common/tools/sbin/soup
index de26e73ea..17339fdd5 100755
--- a/salt/common/tools/sbin/soup
+++ b/salt/common/tools/sbin/soup
@@ -289,25 +289,31 @@ check_os_updates() {
     OSUPDATES=$(yum -q list updates | wc -l)
   fi
   if [[ "$OSUPDATES" -gt 0 ]]; then
-      echo $NEEDUPDATES
-      echo ""
-      read -p "Press U to update OS packages (recommended), C to continue without updates, or E to exit: " confirm
-
-      if [[ "$confirm" == [cC] ]]; then
+      if [[ -z $UNATTENDED ]]; then
+        echo "$NEEDUPDATES"
+        echo ""
+        read -rp "Press U to update OS packages (recommended), C to continue without updates, or E to exit: " confirm
+        if [[ "$confirm" == [cC] ]]; then
           echo "Continuing without updating packages"
-      elif [[ "$confirm" == [uU] ]]; then
+        elif [[ "$confirm" == [uU] ]]; then
           echo "Applying Grid Updates"
-          set +e
-          run_check_net_err "salt '*' -b 5 state.apply patch.os queue=True" 'Could not apply OS updates, please check your network connection.'
-          set -e
-      else
+          update_flag=true
+        else
           echo "Exiting soup"
           exit 0
+        fi
+      else
+        update_flag=true
       fi
   else
-      echo "Looks like you have an updated OS"
+    echo "Looks like you have an updated OS"
+  fi
+
+  if [[ $update_flag == true ]]; then
+    set +e
+    run_check_net_err "salt '*' -b 5 state.apply patch.os queue=True" 'Could not apply OS updates, please check your network connection.'
+    set -e
   fi
-    
 }
 
 clean_dockers() {
@@ -787,7 +793,7 @@ main() {
   echo ""
   check_airgap
   if [[ $is_airgap -eq 0 && $UNATTENDED == true && -z $ISOLOC ]]; then
-    echo "Missing file argument for unattended airgap upgrade."
+    echo "Missing file argument (-f <FILENAME>) for unattended airgap upgrade."
     exit 0
   fi
   echo "Checking to see if this is a manager."
diff --git a/salt/elasticsearch/templates/so/so-common-template.json b/salt/elasticsearch/templates/so/so-common-template.json
index 777bf3f53..c9772b5db 100644
--- a/salt/elasticsearch/templates/so/so-common-template.json
+++ b/salt/elasticsearch/templates/so/so-common-template.json
@@ -8,6 +8,8 @@
     "index.refresh_interval":"30s",
     "index.routing.allocation.require.box_type":"hot",
     "index.mapping.total_fields.limit": "1500",
+    "index.sort.field": "@timestamp",
+    "index.sort.order": "desc",
     "analysis": {
       "analyzer": {
         "es_security_analyzer": {
diff --git a/salt/pcap/files/config b/salt/pcap/files/config
index 048775ef7..900234bc1 100644
--- a/salt/pcap/files/config
+++ b/salt/pcap/files/config
@@ -1,11 +1,13 @@
 {%- set interface = salt['pillar.get']('sensor:interface', 'bond0') %}
 {%- set diskfreepercentage = salt['pillar.get']('steno:diskfreepercentage', 10) %}
+{%- set maxfiles = salt['pillar.get']('steno:maxfiles', 30000) %}
+
 
 {
   "Threads": [
     { "PacketsDirectory": "/nsm/pcap"
     , "IndexDirectory": "/nsm/pcapindex"
-    , "MaxDirectoryFiles": 30000
+    , "MaxDirectoryFiles": {{ maxfiles }}
     , "DiskFreePercentage": {{ diskfreepercentage }}
     }
   ]
@@ -15,4 +17,4 @@
   , "Host": "127.0.0.1"
   , "Flags": ["-v", "--uid=stenographer", "--gid=stenographer"{{ BPF_COMPILED }}]
   , "CertPath": "/etc/stenographer/certs"
-}
\ No newline at end of file
+}