From a9dd520534e2522d9efb75b20baddd98c5b54e72 Mon Sep 17 00:00:00 2001
From: Rafal Lewandowski <rafal@stackhpc.com>
Date: Thu, 27 Nov 2025 11:53:56 +0100
Subject: [PATCH] add filbeat restart to complement the go-w on manifest.yml

---
 etc/kayobe/ansible/deployment/wazuh-manager.yml | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/etc/kayobe/ansible/deployment/wazuh-manager.yml b/etc/kayobe/ansible/deployment/wazuh-manager.yml
index 21c560d5dd..7548421ae0 100644
--- a/etc/kayobe/ansible/deployment/wazuh-manager.yml
+++ b/etc/kayobe/ansible/deployment/wazuh-manager.yml
@@ -134,8 +134,15 @@
       ansible.builtin.file:
         path: "/usr/share/filebeat/module/wazuh/alerts/manifest.yml"
         mode: "go-w"
+      notify:
+        - Restart filebeat
 
   handlers:
+    - name: Restart filebeat
+      ansible.builtin.service:
+        name: filebeat
+        state: restarted
+
     - name: Restart wazuh
       ansible.builtin.service:
         name: wazuh-manager