From 790aa6b684e292d9fb17bc64f33c92caf963aa93 Mon Sep 17 00:00:00 2001
From: m0duspwnens <josh.patterson@securityonionsolutions.com>
Date: Wed, 25 Jan 2023 15:18:56 -0500
Subject: [PATCH] add logstash pillar items for minions

---
 salt/common/tools/sbin/so-minion | 19 +++++++++++++++++++
 setup/so-functions               | 19 +++++--------------
 setup/so-setup                   |  3 +++
 3 files changed, 27 insertions(+), 14 deletions(-)

diff --git a/salt/common/tools/sbin/so-minion b/salt/common/tools/sbin/so-minion
index 1f71eb12e..a51a31ed4 100755
--- a/salt/common/tools/sbin/so-minion
+++ b/salt/common/tools/sbin/so-minion
@@ -119,6 +119,18 @@ function add_elastic_to_minion() {
 		"  " >> $PILLARFILE
 }
 
+function add_logstash_to_minion() {
+	# Create the logstash advanced pillar
+	printf '%s\n'\
+		"logstash_settings:"\
+		"  ls_host: '$LSHOSTNAME'"\
+		"  ls_pipeline_batch_size: 125"\
+		"  ls_input_threads: 1"\
+		"  lsheap: $LSHEAP"\
+		"  ls_pipeline_workers: $CPUCORES"\
+		"  " >> $PILLARFILE
+}
+
 # Analyst Workstation
 function add_analyst_to_minion() {
     printf '%s\n'\
@@ -167,6 +179,7 @@ function add_sensor_to_minion() {
 
 function createEVAL() {
 	add_elastic_to_minion
+	add_logstash_to_minion
 	add_sensor_to_minion
 }
 
@@ -176,20 +189,24 @@ function createIDHNODE() {
 
 function createIMPORT() {
 	add_elastic_to_minion
+	add_logstash_to_minion
 	add_sensor_to_minion
 }
 
 function createHEAVYNODE() {
 	add_elastic_to_minion
+	add_logstash_to_minion
 	add_sensor_to_minion
 }
 
 function createMANAGER() {
 	add_elastic_to_minion
+	add_logstash_to_minion
 }
 
 function createMANAGERSEARCH() {
 	add_elastic_to_minion
+	add_logstash_to_minion
 }
 
 function createSENSOR() {
@@ -198,10 +215,12 @@ function createSENSOR() {
 
 function createSEARCHNODE() {
 	add_elastic_to_minion
+	add_logstash_to_minion
 }
 
 function createSTANDALONE() {
 	add_elastic_to_minion
+	add_logstash_to_minion
 	add_sensor_to_minion
 }
 
diff --git a/setup/so-functions b/setup/so-functions
index a046b49ca..045a728aa 100755
--- a/setup/so-functions
+++ b/setup/so-functions
@@ -1307,15 +1307,7 @@ idh_pillar() {
 logstash_pillar() {
 	# Create the logstash advanced pillar
 	touch $adv_logstash_pillar_file
-	title "Create the logstash pillar"
-	printf '%s\n'\
-		"logstash_settings:"\
-		"  ls_host: '$HOSTNAME'"\
-		"  ls_pipeline_batch_size: 125"\
-		"  ls_input_threads: 1"\
-		"  lsheap: $NODE_LS_HEAP_SIZE"\
-		"  ls_pipeline_workers: $num_cpu_cores"\
-		"" > "$logstash_pillar_file"
+	touch $logstash_pillar_file
 }
 
 # Set Logstash heap size based on total memory
@@ -1339,10 +1331,6 @@ ls_heapsize() {
 	esac
 	export LS_HEAP_SIZE
 
-	if [[ "$install_type" =~ ^(EVAL|MANAGERSEARCH|STANDALONE)$ ]]; then
-		NODE_LS_HEAP_SIZE=$LS_HEAP_SIZE
-		export NODE_LS_HEAP_SIZE
-	fi
 }
 
 idstools_pillar() {
@@ -1887,6 +1875,9 @@ drop_install_options() {
 	NODETYPE=${install_type^^}
 	echo "NODETYPE=$NODETYPE" >> /opt/so/install.txt
 	echo "CORECOUNT=$lb_procs" >> /opt/so/install.txt
+	echo "LSHOSTNAME=$HOSTNAME" >> /opt/so/install.txt
+	echo "LSHEAP=$LS_HEAP_SIZE" >> /opt/so/install.txt
+	echo "CPUCORES=$num_cpu_cores" >> /opt/so/install.txt
 }
 
 remove_package() {
@@ -2391,4 +2382,4 @@ verify_setup() {
 	else
 		whiptail_setup_failed
 	fi
-}
\ No newline at end of file
+}
diff --git a/setup/so-setup b/setup/so-setup
index 2644ca220..ccae9510b 100755
--- a/setup/so-setup
+++ b/setup/so-setup
@@ -528,6 +528,9 @@ if ! [[ -f $install_opt_file ]]; then
 		export PATCHSCHEDULENAME=$PATCHSCHEDULENAME
 		export INTERFACE="bond0"
 		export CORECOUNT=$lb_procs
+		export LSHOSTNAME=$HOSTNAME
+		export LSHEAP=$LS_HEAP_SIZE
+		export CPUCORES=$num_cpu_cores
 		logCmd "so-minion -o=setup" 
 		title "Creating Global SLS"