From e8ba4bdc6cb37fbaeeeef75d5407230d782bd045 Mon Sep 17 00:00:00 2001
From: William Wernert <william.wernert@securityonionsolutions.com>
Date: Fri, 16 Jul 2021 14:07:23 -0400
Subject: [PATCH] Add quotes to string

---
 .../logstash/pipelines/config/so/9800_output_logscan.conf.jinja | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/salt/logstash/pipelines/config/so/9800_output_logscan.conf.jinja b/salt/logstash/pipelines/config/so/9800_output_logscan.conf.jinja
index 6fcf05a70..a0e5bd570 100644
--- a/salt/logstash/pipelines/config/so/9800_output_logscan.conf.jinja
+++ b/salt/logstash/pipelines/config/so/9800_output_logscan.conf.jinja
@@ -7,7 +7,7 @@
 {%- set ES_PASS = salt['pillar.get']('elasticsearch:auth:users:so_elastic_user:pass', '') %}
 
 output {
-  if [module] =~ logscan {
+  if [module] =~ "logscan" {
     elasticsearch {
       id => "logscan_pipeline"
       pipeline => "%{module}"