From b2a83018ba0fe44d77af77b57415264ac19f1a4b Mon Sep 17 00:00:00 2001
From: William Wernert <william.wernert@securityonionsolutions.com>
Date: Thu, 29 Jul 2021 15:14:54 -0400
Subject: [PATCH] Remove or run logscan based on enabled bool

---
 salt/learn/logscan.sls | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/salt/learn/logscan.sls b/salt/learn/logscan.sls
index 1e21e3b2a..cc8bb2996 100644
--- a/salt/learn/logscan.sls
+++ b/salt/learn/logscan.sls
@@ -2,6 +2,14 @@
 {% set IMAGEREPO = salt['pillar.get']('global:imagerepo') %}
 {% set MANAGER = salt['grains.get']('master') %}
 {% set logscan_cpu_period = salt['pillar.get']('learn:modules:logscan:cpu_period', 20000) %}
+{% set enabled = salt['pillar.get']('learn:modules:logscan:enabled', False) %}
+
+{% if enabled %}
+  {% set container_action = 'running' %}
+{% else %}
+  {% set container_action = 'absent'%}
+{% endif %}
+
 
 logscan_data_dir:
   file.directory:
@@ -32,7 +40,8 @@ logscan_log_dir:
     - group: 939
 
 so-logscan:
-  docker_container.running:
+  docker_container.{{ container_action }}:
+    {% if container_action == 'running' %}
     - image: {{ MANAGER }}:5000/{{ IMAGEREPO }}/so-logscan:{{ VERSION }}
     - hostname: logscan
     - name: so-logscan
@@ -42,3 +51,6 @@ so-logscan:
       - /opt/so/log/logscan:/logscan/output:rw
       - /opt/so/log:/logscan/logs:ro
     - cpu_period: {{ logscan_cpu_period }}
+    {% else %}
+    - force: true
+    {% endif %}