Ensure Kratos events are sent to a data stream instead of an index

salt/common/tools/sbin/so-image-common

@@ -37,6 +37,8 @@ container_list() {
       "so-suricata"
       "so-telegraf"
       "so-zeek"
+      "so-elastic-agent"
+      "so-elastic-agent-builder" 
     )
   elif [ $MANAGERCHECK != 'so-helix' ]; then
     TRUSTED_CONTAINERS=(

salt/elasticsearch/defaults.yaml

@@ -2677,6 +2677,9 @@ elasticsearch:
       delete: 365
       index_sorting: False
       index_template:
+        data_stream:
+          hidden: false
+          allow_custom_routing: false
         index_patterns:
           - logs-kratos-so*
         template: