From fe042ed2bb18eac43f8a9fc04291a558d235dd94 Mon Sep 17 00:00:00 2001
From: Mike Reeves <mike.reeves@securityonionsolutions.com>
Date: Tue, 10 Dec 2019 10:59:35 -0500
Subject: [PATCH] Filebeat State - Fix watch statement to only change on yml

---
 salt/filebeat/init.sls | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/salt/filebeat/init.sls b/salt/filebeat/init.sls
index 31c996f51..fce1c6b38 100644
--- a/salt/filebeat/init.sls
+++ b/salt/filebeat/init.sls
@@ -85,4 +85,4 @@ so-filebeat:
 {%- endif %}
       - /etc/ssl/certs/intca.crt:/usr/share/filebeat/intraca.crt:ro
     - watch:
-      - file: /opt/so/conf/filebeat/etc
+      - file: /opt/so/conf/filebeat/etc/filebeat.yml