From 086cf3996da4c9b837b5c5cf7e2e21a75d151337 Mon Sep 17 00:00:00 2001
From: m0duspwnens <josh.patterson@securityonionsolutions.com>
Date: Wed, 13 Jul 2022 11:21:27 -0400
Subject: [PATCH] do not start elastalert if elasticsearch is not v8

---
 salt/elastalert/init.sls | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/salt/elastalert/init.sls b/salt/elastalert/init.sls
index 7f6002331..b1f6bae8e 100644
--- a/salt/elastalert/init.sls
+++ b/salt/elastalert/init.sls
@@ -107,6 +107,10 @@ wait_for_elasticsearch:
   cmd.run:
     - name: so-elasticsearch-wait
 
+is_elasticsearch_v8:
+  cmd.shell:
+    - name: "so-elasticsearch-query / | jq -r '.version.number[0:1]' | grep -q 8" #if not 8 do not start ES
+
 so-elastalert:
   docker_container.running:
     - image: {{ MANAGER }}:5000/{{ IMAGEREPO }}/so-elastalert:{{ VERSION }}
@@ -123,6 +127,7 @@ so-elastalert:
       - {{MANAGER_URL}}:{{MANAGER_IP}}
     - require:
       - cmd: wait_for_elasticsearch
+      - cmd: is_elasticsearch_v8
       - file: elastarules
       - file: elastalogdir
       - file: elastacustmodulesdir