diff --git a/salt/common/tools/sbin/so-image-common b/salt/common/tools/sbin/so-image-common
index 3851d8b4a..aa2292b22 100755
--- a/salt/common/tools/sbin/so-image-common
+++ b/salt/common/tools/sbin/so-image-common
@@ -36,7 +36,9 @@ container_list() {
       "so-steno"
       "so-suricata"
       "so-telegraf"
-      "so-zeek" 
+      "so-zeek"
+      "so-elastic-agent"
+      "so-elastic-agent-builder" 
     )
   elif [ $MANAGERCHECK != 'so-helix' ]; then
     TRUSTED_CONTAINERS=(
diff --git a/salt/elasticsearch/defaults.yaml b/salt/elasticsearch/defaults.yaml
index 11b445c62..3d1182255 100644
--- a/salt/elasticsearch/defaults.yaml
+++ b/salt/elasticsearch/defaults.yaml
@@ -2677,6 +2677,9 @@ elasticsearch:
       delete: 365
       index_sorting: False
       index_template:
+        data_stream:
+          hidden: false
+          allow_custom_routing: false
         index_patterns:
           - logs-kratos-so*
         template: