From 82b1e653b09619396ebfe84624462151fbfc9308 Mon Sep 17 00:00:00 2001
From: Antoine Cotten <hello@acotten.com>
Date: Wed, 2 Mar 2022 16:58:52 +0100
Subject: [PATCH] fix(logstash): Adjust role for ECS compatibility

'ecs_compatibility' is now on by default, therefore Logstash indices are
created with the naming pattern "ecs-logstash-*" when data streams are
disabled ('data_stream => false').
---
 setup/roles/logstash_writer.json | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/setup/roles/logstash_writer.json b/setup/roles/logstash_writer.json
index 7cd38fc..b43861f 100644
--- a/setup/roles/logstash_writer.json
+++ b/setup/roles/logstash_writer.json
@@ -8,7 +8,8 @@
     {
       "names": [
         "logs-generic-default",
-        "logstash-*"
+        "logstash-*",
+        "ecs-logstash-*"
       ],
       "privileges": [
         "write",
@@ -20,7 +21,8 @@
     },
     {
       "names": [
-        "logstash"
+        "logstash",
+        "ecs-logstash"
       ],
       "privileges": [
         "write",