CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-26 02:43:11 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix common pipeline field removal so won't fail for missing fields

Browse Source
This commit is contained in:
Wes Lambert
2020-10-14 13:55:24 +00:00
parent a106913d1a
commit 3c820365ab
1 changed files with 1 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
salt/elasticsearch/files/ingest/common
View File

@@ -37,7 +37,7 @@
{ "convert": { "field": "log.id.uid", "type": "string", "ignore_failure": true, "ignore_missing": true } },
{ "convert": { "field": "agent.id", "type": "string", "ignore_failure": true, "ignore_missing": true } },
{ "convert": { "field": "event.severity", "type": "integer", "ignore_failure": true, "ignore_missing": true } },
{ "remove": { "field": [ "message2", "type", "fields" ], "ignore_failure": true } },
{ "remove": { "field": [ "message2", "type", "fields", "category", "module", "dataset" ], "ignore_missing": true, "ignore_failure": true } },
{
"date_index_name": {
"field": "@timestamp",
@@ -48,6 +48,4 @@
}
}
]
}
]
}