Curator cur_close_days

[endpointsec]

I want to shorten the open indices range from 30 days to 10 or so. Per the directions, I edited cur_close_days in /opt/so/saltstack/local/pillar/minions/$SENSORNAME_$ROLE.sls . Rebooted and restarted curator but the 30-day range still applies to open indices and the curator action logs still show 30 day limits. Am I missing a crucial step?

es_port: 9200
log_size_limit: 56
cur_close_days: 10
grafana: 1
osquery: 0
thehive: 1
playbook: 1

[weslambert]

Try applying either in the minion or global sls, something like the following (will already be like this in the global one):

elasticsearch:
  index_settings:
    so-zeek:
      shards: 1
      warm: 7
      close: 30
      delete: 365

[endpointsec]

Yes! Thanks @weslambert !!!!

Editing the beats section did it! Inside /opt/so/saltstack/local/pillar/global.sls

index_settings: so-beats: shards: 1 warm: 7 close: 10 delete: 15