Create custom index temaplte using salt

[dgmyr]

Version

2.4.30

Installation Method

Network installation on Ubuntu

Description

configuration

Installation Type

Distributed

Location

other (please provide detail below)

Hardware Specs

other (please provide detail below)

CPU

6

RAM

16

Storage for /

200

Storage for /nsm

200

Network Traffic Collection

other (please provide detail below)

Network Traffic Speeds

Less than 1Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

It's possible to create custom index templates via salt? I've tried to place custom json file in /opt/so/saltstack/local/salt/elasticsearch/templates/index/ but after highstate I don't see this template in /opt/so/conf/elasticsearch/templates/index/ . Can you provide to me correct scenario how to create custom index templates and if it's possible to do it without using kibana?
Here is my template:
{
"composed_of": [
"so-data-streams-mappings",
"so-fleet_globals-1",
"so-fleet_agent_id_verification-1",
"so-logs-mappings",
"so-logs-settings"
],
"data_stream": {
"allow_custom_routing": false,
"hidden": false
},
"index_patterns": [
"logs-test-*"
],
"priority": 225,
"template": {
"mappings": {
"_meta": {
"managed": true,
"managed_by": "security_onion",
"package": {
"name": "elastic_agent"
}
}
},
"settings": {
"index": {
"lifecycle": {
"name": "so-logs-logs"
},
"mapping": {
"total_fields": {
"limit": 5001
}
},
"number_of_replicas": 0
}
}
}
}

Guidelines

• I have read the above statement and can confirm my post is relevant to Security Onion 2.4.

[cm-ops]

If you place your custom template in /opt/so/saltstack/local/salt/elasticsearch/templates/index/custom/ and restart Elasticsearch do you see it?

[dgmyr]

Hello, now I can see it in Kibana, so it works. There were some fixes in the 2.4.40 version? I've tried to do the same operations in 2.4.30 without result.

[cm-ops]

Glad it's working, should have worked in 2.4.30 as well.