From f4112b30c0402bdca6a5711a48bff4c88f4e1473 Mon Sep 17 00:00:00 2001
From: weslambert <wlambertts@gmail.com>
Date: Mon, 13 Mar 2023 17:27:06 -0400
Subject: [PATCH] Fix index reference for system auth default

---
 salt/curator/files/action/logs-system-auth-syslog-close.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/salt/curator/files/action/logs-system-auth-syslog-close.yaml b/salt/curator/files/action/logs-system-auth-syslog-close.yaml
index 52ddb5eb5..f71ffacb5 100644
--- a/salt/curator/files/action/logs-system-auth-syslog-close.yaml
+++ b/salt/curator/files/action/logs-system-auth-syslog-close.yaml
@@ -3,7 +3,7 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
-{%- set cur_close_days = CURATORMERGED['logs-import-so'].close %}
+{%- set cur_close_days = CURATORMERGED['logs-system-auth-default'].close %}
 actions:
   1:
     action: close
@@ -17,7 +17,7 @@ actions:
     filters:
     - filtertype: pattern
       kind: regex 
-      value: '^(.ds-logs-import-so.*)$'
+      value: '^(.ds-logs-system.auth-default.*)$'
     - filtertype: age
       source: name
       direction: older