diff --git a/salt/elasticsearch/defaults.yaml b/salt/elasticsearch/defaults.yaml
index 67665a97b..f2245c020 100644
--- a/salt/elasticsearch/defaults.yaml
+++ b/salt/elasticsearch/defaults.yaml
@@ -6,6 +6,8 @@ elasticsearch:
     action:
       destructive_requires_name: true
     cluster:
+      logsdb:
+        enabled: false
       routing:
         allocation:
           disk:
diff --git a/salt/elasticsearch/soc_elasticsearch.yaml b/salt/elasticsearch/soc_elasticsearch.yaml
index 7fd4f8329..2962d7d37 100644
--- a/salt/elasticsearch/soc_elasticsearch.yaml
+++ b/salt/elasticsearch/soc_elasticsearch.yaml
@@ -27,6 +27,13 @@ elasticsearch:
         readonly: True
         global: True
         helpLink: elasticsearch.html
+      logsdb:
+        enabled:
+          description: Enables or disables the Elasticsearch logsdb index mode. When enabled, most logs-* datastreams will convert to logsdb from standard after rolling over.
+          forcedType: bool
+          global: True
+          advanced: True
+          helpLink: elasticsearch.html
       routing:
         allocation:
           disk: