Set replicas for Osquery manager indices to 0

2025-12-07 09:42:46 +01:00 · 2023-03-22 21:47:49 +00:00
parent 3fba27a0d4
commit 84360aa9bf
1 changed files with 15 additions and 0 deletions
--- a/salt/elasticsearch/defaults.yaml
+++ b/salt/elasticsearch/defaults.yaml
@@ -110,6 +110,21 @@ elasticsearch:
            name: elastic_agent
          managed_by: security_onion
          managed: true  
+    logs-osquery-manager:
+      index_sorting: False
+      index_template:
+        index_patterns:
+          - ".logs-osquery*"
+        template:
+          settings:
+            index:
+              number_of_replicas: 0
+        priority: 501
+        _meta:
+          package:
+            name: elastic_agent
+          managed_by: security_onion
+          managed: true
    logs-elastic_agent.apm_server:
      index_sorting: False
      index_template: