From 03b2a7d2dea696df3ad3286b62a64d348d0bda2d Mon Sep 17 00:00:00 2001
From: m0duspwnens <josh.patterson@securityonionsolutions.com>
Date: Thu, 14 Dec 2023 10:01:03 -0500
Subject: [PATCH 1/2] change 9805 pipeline to send to self. fix extra_hosts for
 logstash

---
 salt/logstash/enabled.sls                         | 15 ++++++++++-----
 .../so/9805_output_elastic_agent.conf.jinja       |  6 +++---
 2 files changed, 13 insertions(+), 8 deletions(-)

diff --git a/salt/logstash/enabled.sls b/salt/logstash/enabled.sls
index c76f81d21..c4d223348 100644
--- a/salt/logstash/enabled.sls
+++ b/salt/logstash/enabled.sls
@@ -33,18 +33,23 @@ so-logstash:
       - sobridge:
         - ipv4_address: {{ DOCKER.containers['so-logstash'].ip }}
     - user: logstash
-    - extra_hosts: {{ REDIS_NODES }}
+    - extra_hosts:
+    {% for node in REDIS_NODES %}
+    {%   for hostname, ip in node.items() %}
+      - {{hostname}}:{{ip}}
+    {%   endfor %}
+    {% endfor %}
     {% if DOCKER.containers['so-logstash'].extra_hosts %}
-      {% for XTRAHOST in DOCKER.containers['so-logstash'].extra_hosts %}
+    {%   for XTRAHOST in DOCKER.containers['so-logstash'].extra_hosts %}
       - {{ XTRAHOST }}
-      {% endfor %}
+    {%   endfor %}
     {% endif %}
     - environment:
       - LS_JAVA_OPTS=-Xms{{ lsheap }} -Xmx{{ lsheap }}
     {% if DOCKER.containers['so-logstash'].extra_env %}
-      {% for XTRAENV in DOCKER.containers['so-logstash'].extra_env %}
+    {%   for XTRAENV in DOCKER.containers['so-logstash'].extra_env %}
       - {{ XTRAENV }}
-      {% endfor %}
+    {%   endfor %}
     {% endif %}
     - port_bindings:
       {% for BINDING in DOCKER.containers['so-logstash'].port_bindings %}
diff --git a/salt/logstash/pipelines/config/so/9805_output_elastic_agent.conf.jinja b/salt/logstash/pipelines/config/so/9805_output_elastic_agent.conf.jinja
index f7671e2b7..3a86cd8be 100644
--- a/salt/logstash/pipelines/config/so/9805_output_elastic_agent.conf.jinja
+++ b/salt/logstash/pipelines/config/so/9805_output_elastic_agent.conf.jinja
@@ -3,7 +3,7 @@ output {
     if [metadata][pipeline] {
       if [metadata][_id] {
         elasticsearch {
-          hosts => "{{ GLOBALS.manager }}"
+          hosts => "{{ GLOBALS.hostname }}"
           ecs_compatibility => v8
           data_stream => true
           user => "{{ ES_USER }}"
@@ -17,7 +17,7 @@ output {
       }
       else {
         elasticsearch {
-          hosts => "{{ GLOBALS.manager }}"
+          hosts => "{{ GLOBALS.hostname }}"
           ecs_compatibility => v8
           data_stream => true
           user => "{{ ES_USER }}"
@@ -30,7 +30,7 @@ output {
     }
     else {
       elasticsearch {
-        hosts => "{{ GLOBALS.manager }}"
+        hosts => "{{ GLOBALS.hostname }}"
         ecs_compatibility => v8
         data_stream => true
         user => "{{ ES_USER }}"

From 33a9ac5701bb0396736d495d0423ddf610a97e8d Mon Sep 17 00:00:00 2001
From: m0duspwnens <josh.patterson@securityonionsolutions.com>
Date: Fri, 15 Dec 2023 15:42:49 -0500
Subject: [PATCH 2/2] use logstash nodes for logstash extra_hosts

---
 salt/logstash/enabled.sls | 9 ++-------
 1 file changed, 2 insertions(+), 7 deletions(-)

diff --git a/salt/logstash/enabled.sls b/salt/logstash/enabled.sls
index c4d223348..dbb774d7f 100644
--- a/salt/logstash/enabled.sls
+++ b/salt/logstash/enabled.sls
@@ -8,12 +8,7 @@
 {%   from 'vars/globals.map.jinja' import GLOBALS %}
 {%   from 'docker/docker.map.jinja' import DOCKER %}
 {%   from 'logstash/map.jinja' import LOGSTASH_MERGED %}
-{%   from 'logstash/map.jinja' import REDIS_NODES %}
-{#   we append the manager here so that it is added to extra_hosts so the heavynode can resolve it #}
-{#   we cannont append in the logstash/map.jinja because then it would be added to the 0900_input_redis.conf #}
-{%   if GLOBALS.role == 'so-heavynode' %}
-{%     do REDIS_NODES.append({GLOBALS.manager:GLOBALS.manager_ip}) %}
-{%   endif %}
+{%   from 'logstash/map.jinja' import LOGSTASH_NODES %}
 {%   set lsheap = LOGSTASH_MERGED.settings.lsheap %}
 
 include:
@@ -34,7 +29,7 @@ so-logstash:
         - ipv4_address: {{ DOCKER.containers['so-logstash'].ip }}
     - user: logstash
     - extra_hosts:
-    {% for node in REDIS_NODES %}
+    {% for node in LOGSTASH_NODES %}
     {%   for hostname, ip in node.items() %}
       - {{hostname}}:{{ip}}
     {%   endfor %}