Palo Alto integration index still shows so-logs for the template

[Bal33p]

Version

2.4.20

Installation Method

Network installation on Red Hat derivative like Oracle, Rocky, Alma, etc.

Description

installation

Installation Type

Distributed

Location

cloud

Hardware Specs

Exceeds minimum requirements

CPU

16

RAM

64

Storage for /

500gig

Storage for /nsm

8tb

Network Traffic Collection

other (please provide detail below)

Network Traffic Speeds

Less than 1Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

upgrade removed my config to send logs to proper template
nothing I try is fixing the issue old fix not working

Guidelines

• I have read the above statement and can confirm my post is relevant to Security Onion 2.4.

[reyesj2]

Try adding a custom index template to /opt/so/saltstack/local/salt/elasticsearch/templates/index/custom

so-logs-palo_x_panos_logs:
      index_sorting: False
      index_template:
        index_patterns:
          - "logs-panw.panos-*"
        template:
          settings:
            index:
              number_of_replicas: 0
        composed_of:
          - "logs-panw.panos@package"
          - "logs-panw.panos@custom"
          - "so-fleet_globals-1"
          - "so-fleet_agent_id_verification-1"
        priority: 501
        data_stream:
          hidden: false
          allow_custom_routing: false

[NexusChak]

Had the same question for Fortinet, had to make the priority higher than 225 (which is for so-logs) to make it work. But the new index template will make new indexes and data stream status become "Yellow", any idea?