From d381248e30ac655e8dfd9d91c11ff4155328a8bf Mon Sep 17 00:00:00 2001
From: Josh Patterson <josh.patterson@securityonionsolutions.com>
Date: Tue, 20 Jan 2026 16:27:37 -0500
Subject: [PATCH] fix include

---
 salt/logstash/config.sls | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/salt/logstash/config.sls b/salt/logstash/config.sls
index 69b37cefc..d3df0b20f 100644
--- a/salt/logstash/config.sls
+++ b/salt/logstash/config.sls
@@ -10,10 +10,10 @@
 {%   from 'logstash/map.jinja' import LOGSTASH_MERGED %}
 {%   set ASSIGNED_PIPELINES = LOGSTASH_MERGED.assigned_pipelines.roles[GLOBALS.role.split('-')[1]] %}
 
+{%   if GLOBALS.role not in ['so-receiver','so-fleet'] %}
 include:
-  {% if GLOBALS.role not in ['so-receiver','so-fleet'] %}
   - elasticsearch
-  {% endif %}
+{%   endif %}
 
 # Create the logstash group
 logstashgroup: