From b9980c9d30e547f5ae32e8e8afe15f89f5e78932 Mon Sep 17 00:00:00 2001
From: William Wernert <william.wernert@securityonionsolutions.com>
Date: Fri, 30 Jul 2021 13:09:09 -0400
Subject: [PATCH] Fix pipeline name

---
 .../logstash/pipelines/config/so/9800_output_logscan.conf.jinja | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/salt/logstash/pipelines/config/so/9800_output_logscan.conf.jinja b/salt/logstash/pipelines/config/so/9800_output_logscan.conf.jinja
index a1c621484..38ee29b69 100644
--- a/salt/logstash/pipelines/config/so/9800_output_logscan.conf.jinja
+++ b/salt/logstash/pipelines/config/so/9800_output_logscan.conf.jinja
@@ -10,7 +10,7 @@ output {
   if [module] =~ "logscan" {
     elasticsearch {
       id => "logscan_pipeline"
-      pipeline => "%{module}"
+      pipeline => "logscan"
       hosts => "{{ ES }}"
     {% if salt['pillar.get']('elasticsearch:auth:enabled') is sameas true %}
       user => "{{ ES_USER }}"