use so-elasticsearch-query where possible; simplify suricata.alerts i…

…ndex reroute

Signed-off-by: reyesj2 <[email protected]>

salt/elasticsearch/files/ingest/suricata.alert

@@ -1,7 +1,7 @@
 {
   "description" : "suricata.alert",
   "processors" : [
-    { "set":   { "if": "ctx.event?.imported != null && ctx.event?.imported != true", "field": "_index", "value": "logs-suricata.alerts-so" } },
+    { "set":   { "if": "ctx.event?.imported != true", "field": "_index", "value": "logs-suricata.alerts-so" } },
     { "set":   { "field": "tags","value": "alert" }},
     { "rename":{ "field": "message2.alert",	"target_field": "rule",	"ignore_failure": true 	} },
     { "rename":{ "field": "rule.signature",     "target_field": "rule.name", "ignore_failure": true  } },

salt/manager/tools/sbin/soup

@@ -812,10 +812,9 @@ ASSIST_EOF
 
 rollover_index() {
   idx=$1
-  exists=$(curl -K /opt/so/conf/elasticsearch/curl.config -s -o /dev/null -w "%{http_code}" -k -L -H "Content-Type: application/json" "https://localhost:9200/$idx")
-
+  exists=$(so-elasticsearch-query $idx -o /dev/null -w "%{http_code}")
   if [[ $exists -eq 200 ]]; then
-    rollover=$(curl -K /opt/so/conf/elasticsearch/curl.config -s -o /dev/null -w "%{http_code}" -k -L -H "Content-Type: application/json" "https://localhost:9200/$idx/_rollover" -XPOST)
+    rollover=$(so-elasticsearch-query $idx/_rollover -o /dev/null -w "%{http_code}" -XPOST)
 
     if [[ $rollover -eq 200 ]]; then
       echo "Successfully triggered rollover for $idx..."