From d9f6cde4e19d7d303a2d21418f4e1e5aa06d74ae Mon Sep 17 00:00:00 2001
From: reyesj2 <94730068+reyesj2@users.noreply.github.com>
Date: Thu, 11 Jun 2026 15:11:29 -0500
Subject: [PATCH] remove global setting from data_retention annotation

---
 salt/elasticsearch/soc_elasticsearch.yaml | 2 --
 1 file changed, 2 deletions(-)

diff --git a/salt/elasticsearch/soc_elasticsearch.yaml b/salt/elasticsearch/soc_elasticsearch.yaml
index 251a0c1d8..c95a9467e 100644
--- a/salt/elasticsearch/soc_elasticsearch.yaml
+++ b/salt/elasticsearch/soc_elasticsearch.yaml
@@ -158,7 +158,6 @@ elasticsearch:
               - If retention is less than or equal to 14 days, max_age will be 1 day
               - If retention is less than or equal to 90 days, max_age will be 7 days
               - If retention is greater than 90 days, max_age will be 30 days
-          global: True
           forcedType: string
           regex: ^$|^[0-9]{1,5}(?:d|h|m|s)$
           regexFailureMessage: Must be blank or a number followed by d, h, m, or s, such as 7d.
@@ -353,7 +352,6 @@ elasticsearch:
               - If retention is less than or equal to 14 days, max_age will be 1 day
               - If retention is less than or equal to 90 days, max_age will be 7 days
               - If retention is greater than 90 days, max_age will be 30 days
-          global: True
           forcedType: string
           regex: ^$|^[0-9]{1,5}(?:d|h|m|s)$
           regexFailureMessage: Must be blank or a number followed by d, h, m, or s, such as 7d.