FIX: Add event.category field to pfsense firewall logs #8112

2025-12-08 02:02:50 +01:00 · 2022-06-13 08:03:44 -04:00
parent e405750d26
commit 025993407e
1 changed files with 4 additions and 3 deletions
--- a/salt/elasticsearch/files/ingest/filterlog
+++ b/salt/elasticsearch/files/ingest/filterlog
@@ -54,6 +54,7 @@
     { "community_id": {} },
     { "set":         { "field": "module",	"value": "pfsense",	"override": true	} },
     { "set":         { "field": "dataset",	"value": "firewall",	"override": true	} },
+     { "set":         { "field": "category",	"value": "network",	"override": true	} },
     { "remove":      { "field": ["real_message", "ip_sub_msg", "firewall.sub_message"],     "ignore_failure": true  } }
  ]
 }