Add event_data to common template so elastalert/playbook event_data fields can be indexed and searchable

2025-12-07 17:52:46 +01:00 · 2021-05-03 17:03:30 +00:00
parent da19df5174
commit 619402cc67
1 changed files with 5 additions and 1 deletions
--- a/salt/elasticsearch/templates/so/so-common-template.json
+++ b/salt/elasticsearch/templates/so/so-common-template.json
@@ -228,7 +228,11 @@
        "event":{
          "type":"object",
          "dynamic": true
-        }, 
+        },
+        "event_data":{
+          "type":"object",
+          "dynamic": true
+        },	
        "file":{
          "type":"object",
          "dynamic": true