From 441cd3fc5916640f651eb3f4489ea9a9db7b55a0 Mon Sep 17 00:00:00 2001 From: Wes Lambert Date: Wed, 14 Jul 2021 13:42:51 +0000 Subject: [PATCH] Move Wazuh-specific data to wazuh.data --- salt/elasticsearch/files/ingest/ossec | 1 + 1 file changed, 1 insertion(+) diff --git a/salt/elasticsearch/files/ingest/ossec b/salt/elasticsearch/files/ingest/ossec index 868de2798..69bca3003 100644 --- a/salt/elasticsearch/files/ingest/ossec +++ b/salt/elasticsearch/files/ingest/ossec @@ -33,6 +33,7 @@ { "rename": { "field": "data.win.eventdata.user", "target_field": "user.name", "ignore_missing": true } }, { "rename": { "field": "data.win.system", "target_field": "winlog", "ignore_missing": true } }, { "rename": { "field": "data.win.eventdata", "target_field": "winlog.event_data", "ignore_missing": true } }, + { "rename": { "field": "data", "target_field": "wazuh.data", "ignore_missing": true } }, { "rename": { "field": "winlog.eventID", "target_field": "winlog.event_id", "ignore_missing": true } }, { "rename": { "field": "predecoder.program_name", "target_field": "process.name", "ignore_missing": true } }, { "rename": { "field": "decoder.name", "target_field": "event.dataset", "ignore_missing": true } },