From 716ec7f9362e658c4ecb96069f3a52e504011c49 Mon Sep 17 00:00:00 2001 From: weslambert Date: Fri, 27 Jan 2023 11:02:44 -0500 Subject: [PATCH 1/2] Change event.dataset value from 'files' to 'file' --- salt/elasticsearch/files/ingest/zeek.files | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/salt/elasticsearch/files/ingest/zeek.files b/salt/elasticsearch/files/ingest/zeek.files index 105bbd326..7ce7f9ed5 100644 --- a/salt/elasticsearch/files/ingest/zeek.files +++ b/salt/elasticsearch/files/ingest/zeek.files @@ -1,7 +1,7 @@ { "description" : "zeek.files", "processors" : [ - { "set": { "field": "event.dataset", "value": "files" } }, + { "set": { "field": "event.dataset", "value": "file" } }, { "remove": { "field": ["host"], "ignore_failure": true } }, { "json": { "field": "message", "target_field": "message2", "ignore_failure": true } }, { "rename": { "field": "message2.fuid", "target_field": "log.id.fuid", "ignore_missing": true } }, From 2772b03dca6028c3438c571ec533b34d5948176a Mon Sep 17 00:00:00 2001 From: weslambert Date: Fri, 27 Jan 2023 11:03:49 -0500 Subject: [PATCH 2/2] Change event.dataset value from 'tunnels' to 'tunnel' --- salt/elasticsearch/files/ingest/zeek.tunnels | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/salt/elasticsearch/files/ingest/zeek.tunnels b/salt/elasticsearch/files/ingest/zeek.tunnels index 84fddcda1..934f26beb 100644 --- a/salt/elasticsearch/files/ingest/zeek.tunnels +++ b/salt/elasticsearch/files/ingest/zeek.tunnels @@ -1,7 +1,7 @@ { "description" : "zeek.tunnels", "processors" : [ - { "set": { "field": "event.dataset", "value": "tunnels" } }, + { "set": { "field": "event.dataset", "value": "tunnel" } }, { "remove": { "field": ["host"], "ignore_failure": true } }, { "json": { "field": "message", "target_field": "message2", "ignore_failure": true } }, { "rename": { "field": "message2.tunnel_type", "target_field": "tunnel.type", "ignore_missing": true } },