From 18547e8ea896c08c7401012af129aea9dbb224c2 Mon Sep 17 00:00:00 2001 From: Wes Lambert Date: Mon, 15 Jun 2020 16:54:33 +0000 Subject: [PATCH] enforce field types --- salt/elasticsearch/files/ingest/common | 3 +++ 1 file changed, 3 insertions(+) diff --git a/salt/elasticsearch/files/ingest/common b/salt/elasticsearch/files/ingest/common index a65742f99..d8de06f31 100644 --- a/salt/elasticsearch/files/ingest/common +++ b/salt/elasticsearch/files/ingest/common @@ -39,6 +39,9 @@ { "rename": { "field": "dataset", "target_field": "event.dataset", "ignore_missing": true } }, { "rename": { "field": "category", "target_field": "event.category", "ignore_missing": true } }, { "rename": { "field": "message2.community_id", "target_field": "network.community_id", "ignore_failure": true, "ignore_missing": true } }, + { "convert": { "field": "destination.port", "type": "integer", "ignore_failure": true, "ignore_missing": true } }, + { "convert": { "field": "source.port", "type": "integer", "ignore_failure": true, "ignore_missing": true } }, + { "convert": { "field": "log.id.uid", "type": "string", "ignore_failure": true, "ignore_missing": true } }, { "remove": { "field": [ "index_name_prefix", "message2", "type" ],