From cc30abfe1bec0be56dd07eb9fbdb839e1a504d4b Mon Sep 17 00:00:00 2001
From: Jason Ertel <jason.ertel@securityonionsolutions.com>
Date: Thu, 18 Mar 2021 13:48:57 -0400
Subject: [PATCH] Refresh fieldcaps every 5 minutes

---
 salt/soc/files/soc/soc.json | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/salt/soc/files/soc/soc.json b/salt/soc/files/soc/soc.json
index 5620a190c..6e2850aca 100644
--- a/salt/soc/files/soc/soc.json
+++ b/salt/soc/files/soc/soc.json
@@ -10,6 +10,7 @@
 {%- set WEBSOCKET_TIMEOUT = salt['pillar.get']('sensoroni:websocket_timeout_ms', 0) %}
 {%- set TIP_TIMEOUT = salt['pillar.get']('sensoroni:tip_timeout_ms', 0) %}
 {%- set CACHE_EXPIRATION = salt['pillar.get']('sensoroni:cache_expiration_ms', 0) %}
+{%- set ES_FIELDCAPS_CACHE = salt['pillar.get']('sensoroni:es_fieldcaps_cache_ms', '300000') %}
 {%- import_json "soc/files/soc/alerts.queries.json" as alerts_queries %}
 {%- import_json "soc/files/soc/alerts.actions.json" as alerts_actions %}
 {%- import_json "soc/files/soc/alerts.eventfields.json" as alerts_eventfields %}
@@ -49,6 +50,7 @@
         {%- endif %}
         "username": "",
         "password": "",
+        "cacheMs": {{ ES_FIELDCAPS_CACHE }},
         "verifyCert": false
       },
       "sostatus": {