Syslog to Heavy Node

[34232525]

I feel dumb asking this as this is covered in the "EXAMPLES" section for firewall configuration. I am not having success allowing syslog to my Heavy Node and being able to review by logging into my Manager Search node.

-I've created the host group
-I've added IPs from the syslog sources to that group
-I'm having trouble with building the association between the host group and the syslog port group. the documentation says to add:

firewall:
assigned_hostgroups:
chain:
DOCKER-USER:
hostgroups:
syslogtosensor1:
portgroups:
- portgroups.syslog

To: /opt/so/saltstack/local/pillar/minions/_.sls

I'm not familiar with how the .sls file is being read

[weslambert]

You'll need to add the Salt configuration to the appropriate minion's pillar file. It should be valid YAML, and the configuration will only be considered for that particular minion.