From 9ea292b11e1cd8e96e104278d29779f066371bc9 Mon Sep 17 00:00:00 2001
From: m0duspwnens <josh.patterson@securityonionsolutions.com>
Date: Mon, 8 Nov 2021 13:48:33 -0500
Subject: [PATCH] fix query

---
 ...h_indexing_eps_in_tc_total_graph.json.jinja | 18 +++++++++++++++---
 1 file changed, 15 insertions(+), 3 deletions(-)

diff --git a/salt/grafana/panels/logstash_indexing_eps_in_tc_total_graph.json.jinja b/salt/grafana/panels/logstash_indexing_eps_in_tc_total_graph.json.jinja
index 89e1deef5..fab71fd8b 100644
--- a/salt/grafana/panels/logstash_indexing_eps_in_tc_total_graph.json.jinja
+++ b/salt/grafana/panels/logstash_indexing_eps_in_tc_total_graph.json.jinja
@@ -112,7 +112,7 @@
       "measurement": "logstash_events",
       "orderByTime": "ASC",
       "policy": "default",
-      "query": "SELECT non_negative_derivative(mean(\"in\"), 1s) FROM \"logstash_events\" WHERE (\"cluster_name\" = \"$cluster_name\") AND $timeFilter GROUP BY time($__interval), \"host\" fill(null)",
+      "query": "SELECT non_negative_derivative(mean(\"in\"), 1s) FROM \"logstash_events\" WHERE (\"role\" =~ \"manager\") AND $timeFilter GROUP BY time($__interval), \"host\" fill(null)",
       "rawQuery": false,
       "refId": "A",
       "resultFormat": "time_series",
@@ -138,9 +138,21 @@
       ],
       "tags": [
         {
-          "key": "cluster_name",
+          "key": "role",
+          "operator": "=~",
+          "value": "/^manager/"
+        },
+        {
+          "key": "role",
+          "value": "standalone",
           "operator": "=",
-          "value": "$cluster_name"
+          "condition": "OR"
+        },
+        {
+          "key": "role",
+          "value": "eval",
+          "operator": "=",
+          "condition": "OR"
         }
       ]
     }