From aa7dd47b005a9a959d31bd792818dc56136164d4 Mon Sep 17 00:00:00 2001
From: Mike Reeves <mike.reeves@securityonionsolutions.com>
Date: Mon, 26 Sep 2022 17:01:44 -0400
Subject: [PATCH] Fix zeek logs in filebeat

---
 salt/filebeat/etc/filebeat.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/salt/filebeat/etc/filebeat.yml b/salt/filebeat/etc/filebeat.yml
index afcfcd27b..a35ab545f 100644
--- a/salt/filebeat/etc/filebeat.yml
+++ b/salt/filebeat/etc/filebeat.yml
@@ -131,7 +131,7 @@ filebeat.inputs:
 
 {%- if grains['role'] in ['so-eval', 'so-standalone', 'so-sensor',  'so-helix', 'so-heavynode', 'so-import'] %}
   {%- if ZEEKVER != 'SURICATA' %}
-    {%- for LOGNAME in salt['pillar.get']('zeeklogs:enabled', '')  %}
+    {%- for LOGNAME in salt['pillar.get']('filebeat:zeek_logs_enabled', '')  %}
 - type: filestream
   id: zeek-{{ LOGNAME }}
   paths: