From f3a88de0c393568aed54ef361ae3de9cac685805 Mon Sep 17 00:00:00 2001
From: reyesj2 <94730068+reyesj2@users.noreply.github.com>
Date: Tue, 12 Nov 2024 16:28:01 -0600
Subject: [PATCH] so-(case/detection)history uses same ilm policy as
 so-(case/detection)

Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>
---
 salt/manager/tools/sbin/soup | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/salt/manager/tools/sbin/soup b/salt/manager/tools/sbin/soup
index 3a1e60fd2..96d955422 100755
--- a/salt/manager/tools/sbin/soup
+++ b/salt/manager/tools/sbin/soup
@@ -941,7 +941,14 @@ update_airgap_repo() {
 update_elasticsearch_index_settings() {
   # Update managed indices to reflect latest index template
   for idx in "so-detection" "so-detectionhistory" "so-case" "so-casehistory"; do
-    JSON_STRING=$( jq -n --arg INDEX_NAME "$idx" '{"settings": {"index.auto_expand_replicas":"0-2","index.lifecycle.name":($INDEX_NAME + "-logs")}}')
+    ilm_name=$idx
+    if [ "$idx" = "so-detectionhistory" ]; then
+      ilm_name="so-detection"
+    elif [ "$idx" = "so-casehistory" ]; then
+      ilm_name="so-case"
+    fi
+    JSON_STRING=$( jq -n --arg ILM_NAME "$ilm_name" '{"settings": {"index.auto_expand_replicas":"0-2","index.lifecycle.name":($ILM_NAME + "-logs")}}')
+
     echo "Checking if index \"$idx\" exists"
     exists=$(curl -K /opt/so/conf/elasticsearch/curl.config -s -o /dev/null -w "%{http_code}" -k -L -H "Content-Type: application/json" "https://localhost:9200/$idx")
     if [ $exists -eq 200 ]; then