changes for multipipelines / mastersearch node - https://github.com/Security-Onion-Solutions/securityonion-saltstack/issues/124

salt/utility/bin/crossthestreams.sh

@@ -31,6 +31,8 @@ echo "Applying cross cluster search config..."
 
 # Add all the search nodes to cross cluster searching.
 
-{%- for SN, SNDATA in salt['pillar.get']('nodestab', {}).items() %}
+{%- if salt['pillar.get']('nodestab', {}) %}
+  {%- for SN, SNDATA in salt['pillar.get']('nodestab', {}).items() %}
 curl -XPUT http://{{ ES }}:9200/_cluster/settings -H'Content-Type: application/json' -d '{"persistent": {"search": {"remote": {"{{ SN }}": {"skip_unavailable": "true", "seeds": ["{{ SNDATA.ip }}:9300"]}}}}}'
-{%- endfor %}
+  {%- endfor %}
+{%- endif %}

salt/utility/init.sls

@@ -1,6 +1,5 @@
 # This state is for checking things
-{% if grains['role'] == 'so-master' %}
-{% if salt['pillar.get']('nodestab','') %}
+{% if grains['role'] == 'so-master' or grains['role'] == 'so-mastersearch' %}
 # Make sure Cross Cluster is good. Will need some logic once we have hot/warm
 crossclusterson:
   cmd.script:
@@ -10,7 +9,6 @@ crossclusterson:
     - source: salt://utility/bin/crossthestreams.sh
     - template: jinja
 
-{% endif %}
 {% endif %}
 {% if grains['role'] == 'so-eval' %}
 fixsearch: