From ce1858fe05eedb0ab614e82809cf2e0eccf6532b Mon Sep 17 00:00:00 2001
From: Mike Reeves <mike.reeves@securityonionsolutions.com>
Date: Fri, 27 Oct 2023 09:02:39 -0400
Subject: [PATCH] Annotation changes for warm node

---
 salt/elasticsearch/soc_elasticsearch.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/salt/elasticsearch/soc_elasticsearch.yaml b/salt/elasticsearch/soc_elasticsearch.yaml
index 189471226..8bee839c1 100644
--- a/salt/elasticsearch/soc_elasticsearch.yaml
+++ b/salt/elasticsearch/soc_elasticsearch.yaml
@@ -109,7 +109,7 @@ elasticsearch:
           warm:
             min_age: 
               description: Minimum age of index. ex. 30d - This determines when the index should be moved to the cold tier.  While still searchable, this tier is typically optimized for lower storage costs rather than search speed.
-              regex: ^[0-9]d$
+              regex: ^\[0-9\]{1-5}d$
             actions:
               set_priority:
                 priority: