From c06c08b10828100ba1d1846fae2ed0c91326132d Mon Sep 17 00:00:00 2001
From: Mike Reeves <mike.reeves@securityonionsolutions.com>
Date: Mon, 12 Feb 2018 09:29:23 -0500
Subject: [PATCH] LS salt module - add pipeline.yml

---
 salt/logstash/files/logstash.yml | 12 +-----------
 salt/logstash/files/pipeline.yml | 17 +++++++++++++++++
 2 files changed, 18 insertions(+), 11 deletions(-)
 create mode 100644 salt/logstash/files/pipeline.yml

diff --git a/salt/logstash/files/logstash.yml b/salt/logstash/files/logstash.yml
index 8de46a109..39c545f1c 100644
--- a/salt/logstash/files/logstash.yml
+++ b/salt/logstash/files/logstash.yml
@@ -1,16 +1,6 @@
-{%- set freq = salt['pillar.get']('master:freq', '0') %}
-{%- set domainstats = salt['pillar.get']('master:domainstats', '0') %}
-{%- if freq == '0' and domainstats == '0' %}
-path.config: {/usr/share/logstash/pipeline,/usr/share/logstash/custom}
-{%- elif freq == '1' and domainstats == '0' %}
-path.config: {/usr/share/logstash/pipeline,/usr/share/logstash/custom,/usr/share/logstash/freq}
-{%- elif freq == '0' and domainstats == '1' %}
-path.config: {/usr/share/logstash/pipeline,/usr/share/logstash/custom,/usr/share/logstash/domainstats}
-{%- elif freq == '1' and domainstats == '1' %}
-path.config: {/usr/share/logstash/pipeline,/usr/share/logstash/custom,/usr/share/logstash/freq,/usr/share/logstash/domainstats}
-{%- endif %}
 http.host: 0.0.0.0
 queue.type: persisted
 queue.max_bytes: 1gb
 pipeline.workers: 1
 path.logs: /var/log/logstash
+path.settings: /usr/share/logstash/settings
diff --git a/salt/logstash/files/pipeline.yml b/salt/logstash/files/pipeline.yml
new file mode 100644
index 000000000..090e6d6f0
--- /dev/null
+++ b/salt/logstash/files/pipeline.yml
@@ -0,0 +1,17 @@
+{%- set freq = salt['pillar.get']('master:freq', '0') %}
+{%- set domainstats = salt['pillar.get']('master:domainstats', '0') %}
+- pipeline.id: sodefault
+  path.config: "/usr/share/logstash/pipeline"
+  queue.type: persisted
+- pipline.id: custom
+  path.config: "/usr/share/logstash/custom"
+  queue.type: persisted
+{%- if freq == '1' %}
+- pipeline.id: freq
+  path.config: "/usr/share/logstash/freq"
+  queue.type: persisted
+{%- if domainstats == '1' %}
+- pipeline.id: domainstats
+  path.config: "/usr/share/logstash/domainstats"
+  queue.type: persisted
+{%- endif %}