diff --git a/salt/logstash/pipelines/config/so/9700_output_strelka.conf.jinja b/salt/logstash/pipelines/config/so/9700_output_strelka.conf.jinja
index 1e192a8ee..5116b86ea 100644
--- a/salt/logstash/pipelines/config/so/9700_output_strelka.conf.jinja
+++ b/salt/logstash/pipelines/config/so/9700_output_strelka.conf.jinja
@@ -1,7 +1,7 @@
 {%- if grains['role'] == 'so-eval' -%}
 {%- set ES = salt['pillar.get']('master:mainip', '') -%}
 {%- else %}
-{%- set ES = salt['pillar.get']('node:mainip', '') -%}
+{%- set ES = salt['pillar.get']('elasticsearch:mainip', '') -%}
 {%- endif %}
 # Author: Justin Henderson
 #         SANS Instructor and author of SANS SEC555: SIEM and Tactical Analytics