Add keyword subfield for event.severity_label

2025-12-06 17:22:49 +01:00 · 2022-01-07 11:21:57 -05:00
parent c69e1353d9
commit 770e53d914
1 changed files with 6 additions and 1 deletions
--- a/salt/elasticsearch/templates/so/so-common-template.json.jinja
+++ b/salt/elasticsearch/templates/so/so-common-template.json.jinja
@@ -397,7 +397,12 @@
            },
 	    "severity_label": {
              "ignore_above": 1024,
-              "type": "keyword"
+              "type": "keyword".
+	      "fields": {
+                "keyword": {
+                  "type": "keyword"
+                }
+              }
            },
            "start": {
              "type": "date"