From 8e92060c293ce882b3e6317f4281303578794462 Mon Sep 17 00:00:00 2001
From: weslambert <wlambertts@gmail.com>
Date: Wed, 13 Jul 2022 08:38:55 -0400
Subject: [PATCH] Ensure Elastalert indices are deleted before continuing with
 SOUP -- if they are not, generate a failure condition

---
 salt/common/tools/sbin/soup | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/salt/common/tools/sbin/soup b/salt/common/tools/sbin/soup
index d900e465a..44cfd67fc 100755
--- a/salt/common/tools/sbin/soup
+++ b/salt/common/tools/sbin/soup
@@ -851,6 +851,13 @@ up_to_2.3.140() {
    
    # Delete Elastalert indices
    for i in $(so-elasticsearch-query _cat/indices | grep elastalert | awk '{print $3}'); do so-elasticsearch-query $i -XDELETE; done
+   # Check to ensure Elastalert indices have been deleted
+   RESPONSE=$(so-elasticsearch-query elastalert*)
+   if [[ "$RESPONSE" == "{}" ]]; then
+     echo "Elastalert indices have been deleted."
+   else
+     fail "Something went wrong. Could not delete the Elastalert indices. Exiting."
+   fi
    ##
    INSTALLEDVERSION=2.3.140
 }