From ac28f90af3bd66a6f443711fa3be61c8ef4d9f92 Mon Sep 17 00:00:00 2001 From: weslambert Date: Wed, 2 Aug 2023 13:15:11 -0400 Subject: [PATCH 1/2] Remove override --- salt/elasticsearch/files/ingest/filterlog | 1 - 1 file changed, 1 deletion(-) diff --git a/salt/elasticsearch/files/ingest/filterlog b/salt/elasticsearch/files/ingest/filterlog index fb197c706..850c15d99 100644 --- a/salt/elasticsearch/files/ingest/filterlog +++ b/salt/elasticsearch/files/ingest/filterlog @@ -49,7 +49,6 @@ "on_failure" : [ {"set" : {"field" : "error.message","value" : "{{ _ingest.on_failure_message }}"}}] } }, - { "set": { "field": "_index", "value": "so-firewall", "override": true } }, { "set": { "if": "ctx.network?.transport_id == '0'", "field": "network.transport", "value": "icmp", "override": true } }, { "community_id": {} }, { "set": { "field": "module", "value": "pfsense", "override": true } }, From f1023510524d5c46a5ebca8acf6cf2293faa6026 Mon Sep 17 00:00:00 2001 From: weslambert Date: Wed, 2 Aug 2023 13:25:44 -0400 Subject: [PATCH 2/2] Add event --- salt/elasticsearch/files/ingest/filterlog | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/salt/elasticsearch/files/ingest/filterlog b/salt/elasticsearch/files/ingest/filterlog index 850c15d99..52d83dd0a 100644 --- a/salt/elasticsearch/files/ingest/filterlog +++ b/salt/elasticsearch/files/ingest/filterlog @@ -51,8 +51,8 @@ }, { "set": { "if": "ctx.network?.transport_id == '0'", "field": "network.transport", "value": "icmp", "override": true } }, { "community_id": {} }, - { "set": { "field": "module", "value": "pfsense", "override": true } }, - { "set": { "field": "dataset", "value": "firewall", "override": true } }, + { "set": { "field": "event.module", "value": "pfsense", "override": true } }, + { "set": { "field": "event.dataset", "value": "firewall", "override": true } }, { "set": { "field": "category", "value": "network", "override": true } }, { "remove": { "field": ["real_message", "ip_sub_msg", "firewall.sub_message"], "ignore_failure": true } } ]