From 9c3f476f6d9ebf07b6cae5e5bfb60879100bca4b Mon Sep 17 00:00:00 2001
From: Josh Brower <josh@defensivedepth.com>
Date: Fri, 28 Dec 2018 13:50:43 -0500
Subject: [PATCH] add bind for fleet logs

---
 salt/filebeat/init.sls | 1 +
 1 file changed, 1 insertion(+)

diff --git a/salt/filebeat/init.sls b/salt/filebeat/init.sls
index d3a1dfb14..65f22a2e1 100644
--- a/salt/filebeat/init.sls
+++ b/salt/filebeat/init.sls
@@ -63,6 +63,7 @@ so-filebeat:
       - /opt/so/log/suricata:/suricata:ro
       - /opt/so/wazuh/logs/alerts/:/wazuh/alerts:ro
       - /opt/so/wazuh/logs/archives/:/wazuh/archives:ro
+      - /opt/so/log/fleet/:/osquery/logs:ro
 {%- if grains['role'] == 'so-master' %}
       - /etc/pki/filebeat.crt:/usr/share/filebeat/filebeat.crt:ro
       - /etc/pki/filebeat.key:/usr/share/filebeat/filebeat.key:ro