Merge branch 'dev' into kilo

salt/elasticsearch/files/ingest/import.wel

@@ -4,6 +4,7 @@
     { "remove":         { "field": ["event.created","timestamp", "winlog.event_data.UtcTime", "event_record_id"],     "ignore_failure": true                                               } },
     { "pipeline":      { "if": "ctx.winlog?.channel == 'Microsoft-Windows-Sysmon/Operational'",   "name": "sysmon"  }  },
     { "pipeline":      { "if": "ctx.winlog?.channel != 'Microsoft-Windows-Sysmon/Operational'",  "name":"win.eventlogs" }  },
+    { "dissect":       { "field": "log.file.name", "pattern" : "/tmp/%{import.id}.evtx" } },
     { "pipeline":    { "name": "common" } }
   ]
 }

salt/elasticsearch/templates/so/so-common-template.json

@@ -1,3 +1,4 @@
+{%- set INDEX_SORTING = salt['pillar.get']('elasticsearch:index_sorting', True) %}
 {
   "index_patterns": ["so-*"],
   "version":50001,
@@ -8,8 +9,10 @@
     "index.refresh_interval":"30s",
     "index.routing.allocation.require.box_type":"hot",
     "index.mapping.total_fields.limit": "1500",
+{%- if INDEX_SORTING is sameas true %}
     "index.sort.field": "@timestamp",
     "index.sort.order": "desc",
+{%- endif %}
     "analysis": {
       "analyzer": {
         "es_security_analyzer": {