Update to 2020-05-27 13:00

roles/elasticsearch/templates/post-backup.j2

@@ -6,3 +6,4 @@ rm -rf {{ es_backup_dir }}/*
 # Can't delete elasticsearch dumps, set es_backup_dir to a non empty path
 {% endif %}
 umount /home/lbkp/es
+fstrim -a -v

roles/graylog/defaults/main.yml

@@ -61,3 +61,8 @@ graylog_mongodb_uri:
 # If you want to obtain a cert with dehydrated
 # it'll be deployed as {{ graylog_root_dir }}/ssl/cert.pem and {{ graylog_root_dir }}/ssl/key.pem
 # graylog_letsencrypt_cert: graylog.domain.tls
+
+# If set, will populate enabled_tls_protocols
+# on el7, TLSv1.3 seems to break filebeat connections, so, just enable TLSv1.2
+graylog_tls_versions:
+  - TLSv1.2

roles/graylog/templates/server.conf.j2

@@ -43,3 +43,7 @@ allow_leading_wildcard_searches = true
 {% if 'dnsresolver' in graylog_plugins_to_install %}
 dns_resolver_enabled = true
 {% endif %}
+
+{% if graylog_tls_versions | length > 0 %}
+enabled_tls_protocols = {{ graylog_tls_versions | join(',') }}
+{% endif %}