From e927356113265aec35368a771bb4d50aa0c6f0fe Mon Sep 17 00:00:00 2001
From: Salvatore Campagna <salvatore.campagna@elastic.co>
Date: Fri, 30 Aug 2024 14:59:50 +0200
Subject: [PATCH] fix: prevent usage of ilm lifecycle in serverless

---
 .../templates/composable/security-auditbeat.json       | 10 +++++++---
 .../templates/composable/security-filebeat.json        | 10 +++++++---
 .../templates/composable/security-metricbeat.json      | 10 +++++++---
 .../templates/composable/security-packetbeat.json      | 10 +++++++---
 .../templates/composable/security-winlogbeat.json      | 10 +++++++---
 5 files changed, 35 insertions(+), 15 deletions(-)

diff --git a/elastic/security/templates/composable/security-auditbeat.json b/elastic/security/templates/composable/security-auditbeat.json
index 4cce3871a..b0e103ad3 100644
--- a/elastic/security/templates/composable/security-auditbeat.json
+++ b/elastic/security/templates/composable/security-auditbeat.json
@@ -5,9 +5,13 @@
   "template" : {
     "settings" : {
       "index" : {
-        "lifecycle" : {
-          "name" : "security"
-        },
+        {% if lifecycle == "ilm" or (not lifecycle and build_flavor == "default") %}
+          "lifecycle": {
+            "name": "security"
+          },
+        {%- elif lifecycle == "dlm" or (not lifecycle and build_flavor == "serverless") %}
+            "lifecycle": {},
+        {%- endif -%}
         "mapping" : {
           "total_fields" : {
             "limit" : "10000"
diff --git a/elastic/security/templates/composable/security-filebeat.json b/elastic/security/templates/composable/security-filebeat.json
index ebda1fb7a..06e6e8e8d 100644
--- a/elastic/security/templates/composable/security-filebeat.json
+++ b/elastic/security/templates/composable/security-filebeat.json
@@ -5,9 +5,13 @@
   "template" : {
     "settings" : {
       "index" : {
-        "lifecycle" : {
-          "name" : "security"
-        },
+        {% if lifecycle == "ilm" or (not lifecycle and build_flavor == "default") %}
+          "lifecycle": {
+            "name": "security"
+          },
+        {%- elif lifecycle == "dlm" or (not lifecycle and build_flavor == "serverless") %}
+            "lifecycle": {},
+        {%- endif -%}
         "mapping" : {
           "total_fields" : {
             "limit" : "10000"
diff --git a/elastic/security/templates/composable/security-metricbeat.json b/elastic/security/templates/composable/security-metricbeat.json
index ba5edaf65..c13babeef 100644
--- a/elastic/security/templates/composable/security-metricbeat.json
+++ b/elastic/security/templates/composable/security-metricbeat.json
@@ -5,9 +5,13 @@
   "template" : {
     "settings" : {
       "index" : {
-        "lifecycle" : {
-          "name" : "security"
-        },
+        {% if lifecycle == "ilm" or (not lifecycle and build_flavor == "default") %}
+          "lifecycle": {
+            "name": "security"
+          },
+        {%- elif lifecycle == "dlm" or (not lifecycle and build_flavor == "serverless") %}
+            "lifecycle": {},
+        {%- endif -%}
         "codec" : "best_compression",
         "mapping" : {
           "total_fields" : {
diff --git a/elastic/security/templates/composable/security-packetbeat.json b/elastic/security/templates/composable/security-packetbeat.json
index 8ee5b913e..3064235df 100644
--- a/elastic/security/templates/composable/security-packetbeat.json
+++ b/elastic/security/templates/composable/security-packetbeat.json
@@ -5,9 +5,13 @@
   "template" : {
     "settings" : {
       "index" : {
-        "lifecycle" : {
-          "name" : "security"
-        },
+        {% if lifecycle == "ilm" or (not lifecycle and build_flavor == "default") %}
+          "lifecycle": {
+            "name": "security"
+          },
+        {%- elif lifecycle == "dlm" or (not lifecycle and build_flavor == "serverless") %}
+            "lifecycle": {},
+        {%- endif -%}
         "mapping" : {
           "total_fields" : {
             "limit" : "10000"
diff --git a/elastic/security/templates/composable/security-winlogbeat.json b/elastic/security/templates/composable/security-winlogbeat.json
index e49ede61b..c6917dcbb 100644
--- a/elastic/security/templates/composable/security-winlogbeat.json
+++ b/elastic/security/templates/composable/security-winlogbeat.json
@@ -5,9 +5,13 @@
   "template" : {
     "settings" : {
       "index" : {
-        "lifecycle" : {
-          "name" : "security"
-        },
+        {% if lifecycle == "ilm" or (not lifecycle and build_flavor == "default") %}
+          "lifecycle": {
+            "name": "security"
+          },
+        {%- elif lifecycle == "dlm" or (not lifecycle and build_flavor == "serverless") %}
+            "lifecycle": {},
+        {%- endif -%}
         "mapping" : {
           "total_fields" : {
             "limit" : "10000"