From f40a7b927297f8aa46c9bdd0b9d036dfac3abaa5 Mon Sep 17 00:00:00 2001
From: Mike Reeves <mike.reeves@securityonionsolutions.com>
Date: Thu, 19 Apr 2018 20:48:07 -0400
Subject: [PATCH] FileBeat Module - Fix yaml

---
 salt/filebeat/init.sls | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/salt/filebeat/init.sls b/salt/filebeat/init.sls
index a8a17dc73..17d1f9e8d 100644
--- a/salt/filebeat/init.sls
+++ b/salt/filebeat/init.sls
@@ -26,8 +26,8 @@ filebeatconfsync:
   file.recurse:
     - name: /opt/so/conf/filebeat/etc
     - source: salt://filebeat/etc
-    - user: 939
-    - group: 939
+    - user: 0
+    - group: 0
     - template: jinja
 
 docker.elastic.co/beats/filebeat:6.2.4:
@@ -37,6 +37,7 @@ so-filebeat:
   docker_container.running:
     - image: docker.elastic.co/beats/filebeat:6.2.4
     - hostname: so-filebeat
+    - user: root
     - binds:
       - /opt/so/log/filebeat:/var/log/filebeat:rw
       - /opt/so/conf/filebeat/etc/filebeat.yml:/usr/share/filebeat/filebeat.yml:ro