Merge pull request #15448 from Security-Onion-Solutions/reyesj2-patch-14

salt/elasticsearch/defaults.yaml

@@ -6,6 +6,8 @@ elasticsearch:
     action:
       destructive_requires_name: true
     cluster:
+      logsdb:
+        enabled: false
       routing:
         allocation:
           disk:

salt/elasticsearch/soc_elasticsearch.yaml

@@ -27,6 +27,13 @@ elasticsearch:
         readonly: True
         global: True
         helpLink: elasticsearch.html
+      logsdb:
+        enabled:
+          description: Enables or disables the Elasticsearch logsdb index mode. When enabled, most logs-* datastreams will convert to logsdb from standard after rolling over.
+          forcedType: bool
+          global: True
+          advanced: True
+          helpLink: elasticsearch.html
       routing:
         allocation:
           disk: