From af4b34801f958b9110e4de3837b01e3d8d341018 Mon Sep 17 00:00:00 2001
From: Josh Patterson <josh.patterson@securityonionsolutions.com>
Date: Wed, 25 Oct 2023 15:48:27 -0400
Subject: [PATCH] Update defaults.yaml

---
 salt/elasticsearch/defaults.yaml | 38 ++++++++++++++++++++++++++++++++
 1 file changed, 38 insertions(+)

diff --git a/salt/elasticsearch/defaults.yaml b/salt/elasticsearch/defaults.yaml
index 1296ef549..5449df506 100644
--- a/salt/elasticsearch/defaults.yaml
+++ b/salt/elasticsearch/defaults.yaml
@@ -4920,3 +4920,41 @@ elasticsearch:
         data_stream:
           hidden: false
           allow_custom_routing: false
+  so_roles:
+    so-manager:
+      node:
+        roles:
+          - master
+          - data
+          - remote_cluster_client
+          - transform
+    so-managersearch:
+      node:
+        roles:
+          - master
+          - data_hot
+          - remote_cluster_client
+    so-standalone:
+      node:
+        roles:
+          - master
+          - data_hot
+          - remote_cluster_client
+    so-searchnode:
+      node:
+        roles:
+          - data_hot
+          - ingest
+    so-heavynode:
+      node:
+        roles:
+          - master
+          - data
+          - remote_cluster_client
+          - ingest
+    so-eval:
+      node:
+        roles: []
+    so-import:
+      node:
+        roles: []