From e5226b50edb36e2cae51a77bc5523cf93193931e Mon Sep 17 00:00:00 2001
From: reyesj2 <94730068+reyesj2@users.noreply.github.com>
Date: Tue, 27 Jan 2026 16:37:23 -0600
Subject: [PATCH] disable logstash metrics collection on nodes not running
 logstash + fleet nodes

---
 salt/telegraf/etc/telegraf.conf | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/salt/telegraf/etc/telegraf.conf b/salt/telegraf/etc/telegraf.conf
index d2cb87057..e74c79f6c 100644
--- a/salt/telegraf/etc/telegraf.conf
+++ b/salt/telegraf/etc/telegraf.conf
@@ -7,6 +7,7 @@
 {%- set UNIQUEID = salt['pillar.get']('sensor:uniqueid', '') %}
 {%- set ZEEK_ENABLED = salt['pillar.get']('zeek:enabled', True) %}
 {%- set MDENGINE = GLOBALS.md_engine %}
+{%- set LOGSTASH_ENABLED = salt['pillar.get']('logstash:enabled', False) %}
 # Global tags can be specified here in key="value" format.
 [global_tags]
   role = "{{ GLOBALS.role.split('-') | last }}"
@@ -241,12 +242,8 @@
 #   ## Use TLS but skip chain & host verification
 #   # insecure_skip_verify = false
 
-{%- set logstash_metrics_roles = ['so-searchnode','so-standalone','so-managersearch','so-heavynode'] %}
-{%- if GLOBALS.pipeline != "KAFKA" %}
-{%-   set logstash_metrics_roles = logstash_metrics_roles + ['so-manager', 'so-receiver'] %}
-{%- endif %}
-
-{%- if grains.role in logstash_metrics_roles %}
+{#- Fleet nodes do not have pillar access to logstash credentials #}
+{%- if LOGSTASH_ENABLED and grains.role != 'so-fleet' %}
 [[inputs.logstash]]
   url = "http://localhost:9600"
   collect = ["pipelines"]