diff --git a/salt/curator/files/action/logs-system-auth-default-close.yaml b/salt/curator/files/action/logs-system-auth-default-close.yaml
index 7c04a0ca9..af9843b35 100644
--- a/salt/curator/files/action/logs-system-auth-default-close.yaml
+++ b/salt/curator/files/action/logs-system-auth-default-close.yaml
@@ -3,7 +3,7 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
-{%- set cur_close_days = CURATORMERGED['logs-system.auth-default'].close %}
+{%- set cur_close_days = CURATORMERGED['logs-system-auth-default'].close %}
 actions:
   1:
     action: close
diff --git a/salt/curator/files/action/logs-system-auth-default-delete.yaml b/salt/curator/files/action/logs-system-auth-default-delete.yaml
index d14d560f3..9a1cc6a9a 100644
--- a/salt/curator/files/action/logs-system-auth-default-delete.yaml
+++ b/salt/curator/files/action/logs-system-auth-default-delete.yaml
@@ -3,7 +3,7 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
-{%- set DELETE_DAYS = CURATORMERGED['logs-system.auth-default'].delete %}
+{%- set DELETE_DAYS = CURATORMERGED['logs-system-auth-default'].delete %}
 actions:
   1:
     action: delete_indices
diff --git a/salt/curator/files/action/logs-system-auth-syslog-close.yaml b/salt/curator/files/action/logs-system-auth-syslog-close.yaml
deleted file mode 100644
index 52ddb5eb5..000000000
--- a/salt/curator/files/action/logs-system-auth-syslog-close.yaml
+++ /dev/null
@@ -1,27 +0,0 @@
-# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
-# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at 
-# https://securityonion.net/license; you may not use this file except in compliance with the
-# Elastic License 2.0.
-
-{%- set cur_close_days = CURATORMERGED['logs-import-so'].close %}
-actions:
-  1:
-    action: close
-    description: >-
-      Close import indices older than {{cur_close_days}} days.
-    options:
-      delete_aliases: False
-      timeout_override:
-      continue_if_exception: False
-      disable_action: False
-    filters:
-    - filtertype: pattern
-      kind: regex 
-      value: '^(.ds-logs-import-so.*)$'
-    - filtertype: age
-      source: name
-      direction: older
-      timestring: '%Y.%m.%d'
-      unit: days
-      unit_count: {{cur_close_days}}
-      exclude:
diff --git a/salt/curator/files/action/logs-system-syslog-default-close.yaml b/salt/curator/files/action/logs-system-syslog-default-close.yaml
index a9a697a66..3c9482b40 100644
--- a/salt/curator/files/action/logs-system-syslog-default-close.yaml
+++ b/salt/curator/files/action/logs-system-syslog-default-close.yaml
@@ -3,7 +3,7 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
-{%- set cur_close_days = CURATORMERGED['logs-system.syslog-default'].close %}
+{%- set cur_close_days = CURATORMERGED['logs-system-syslog-default'].close %}
 actions:
   1:
     action: close
diff --git a/salt/curator/files/action/logs-system-syslog-default-delete.yaml b/salt/curator/files/action/logs-system-syslog-default-delete.yaml
index b46a5fc73..1a7d217e9 100644
--- a/salt/curator/files/action/logs-system-syslog-default-delete.yaml
+++ b/salt/curator/files/action/logs-system-syslog-default-delete.yaml
@@ -3,19 +3,19 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
-{%- set DELETE_DAYS = CURATORMERGED['logs-import-so'].delete %}
+{%- set DELETE_DAYS = CURATORMERGED['logs-system-syslog-default'].delete %}
 actions:
   1:
     action: delete_indices
     description: >-
-      Delete import indices when older than {{ DELETE_DAYS }} days.
+      Delete Elastic Agent system syslog indices when older than {{ DELETE_DAYS }} days.
     options:
       ignore_empty_list: True
       disable_action: False
     filters:
     - filtertype: pattern
       kind: regex
-      value: '^(.ds-logs-import-so.*)$'
+      value: '^(.ds-logs-system.syslog-default.*)$'
     - filtertype: age
       source: name
       direction: older