Files
securityonion/salt
Josh Patterson c1f256e630 Correct pipeline_settings annotations against Logstash 9.3.7
Widen the byte-size regex, which rejected values Logstash accepts and so
blocked the save in SOC: bare-letter units (1g, 512m, 64k), decimals
(1.5gb), whitespace before the unit, and a bare integer. Allow whitespace
in dead_letter_queue.retain.age (5 d). Both stay lowercase-only, matching
byte_value.rb and AbstractPipelineExt.parseToDuration.

Fix description gaps: queue.checkpoint.retry is a Windows/SAN workaround
Elastic does not otherwise recommend, batch metrics sampling is technical
preview, queue.checkpoint.interval is deprecated in 9.1, compression makes
a queue unreadable by Logstash before 9.2, flush_check_interval has a
1000ms floor, max_events counts unread events, and the path settings are
created by Logstash but reject symlinks. Note which settings apply only to
persisted queues or an enabled DLQ.

Drop the undocumented 'disabled' value from queue.compression.

Numeric fields stay stricter than NumericSetting, which has no validator
and would accept negatives, floats and NaN in event counts and intervals.
2026-08-20 16:35:31 -04:00
..
2025-12-02 11:16:08 -06:00
2026-08-14 13:54:14 -04:00
2025-12-11 17:30:06 -05:00
2025-12-02 11:16:08 -06:00
2026-07-15 16:28:35 -04:00
2026-08-03 15:19:18 -04:00
2026-03-19 14:39:10 -04:00
2026-08-13 12:09:59 -04:00
2026-01-07 14:14:57 -05:00
2025-10-14 11:03:00 -04:00
2026-08-14 16:04:48 -04:00