From 842aa97f7e9dd32ea9974e2d0db8bd8e04a08397 Mon Sep 17 00:00:00 2001
From: m0duspwnens <josh.patterson@securityonionsolutions.com>
Date: Wed, 26 May 2021 11:00:18 -0400
Subject: [PATCH] load filebeat modules when es container starts and if fb
 container is running

---
 salt/filebeat/init.sls | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/salt/filebeat/init.sls b/salt/filebeat/init.sls
index 372656038..312e815c9 100644
--- a/salt/filebeat/init.sls
+++ b/salt/filebeat/init.sls
@@ -22,6 +22,13 @@
 {% set MANAGERIP = salt['pillar.get']('global:managerip', '') %}
 {% from 'filebeat/map.jinja' import THIRDPARTY with context %}
 {% from 'filebeat/map.jinja' import SO with context %}
+{% set ES_INCLUDED_NODES = ['so-standalone'] %}
+
+#only include elastic state for certain nodes
+{% if grains.role in ES_INCLUDED_NODES %}
+include:
+  - elasticsearch
+{% endif %}
 
 filebeatetcdir:
   file.directory:
@@ -126,6 +133,16 @@ so-filebeat:
     - watch:
       - file: /opt/so/conf/filebeat/etc/filebeat.yml
 
+{% if grains.role in ES_INCLUDED_NODES %}
+run_module_setup:
+  cmd.run:
+    - name: /usr/sbin/so-filebeat-module-setup
+    - require:
+      - docker_container: so-filebeat
+    - onchanges_in:
+      - docker_container: so-elasticsearch
+{% endif %}
+
 append_so-filebeat_so-status.conf:
   file.append:
     - name: /opt/so/conf/so-status/so-status.conf