From d6afde90b06fbc437d44f1395f854909da73377e Mon Sep 17 00:00:00 2001 From: Wes Lambert Date: Tue, 14 Jul 2020 13:37:00 +0000 Subject: [PATCH] Convert message timestamp to @timestamp --- salt/elasticsearch/files/ingest/suricata.common | 2 ++ 1 file changed, 2 insertions(+) diff --git a/salt/elasticsearch/files/ingest/suricata.common b/salt/elasticsearch/files/ingest/suricata.common index dd08b08a0..435f845c1 100644 --- a/salt/elasticsearch/files/ingest/suricata.common +++ b/salt/elasticsearch/files/ingest/suricata.common @@ -12,6 +12,8 @@ { "remove":{ "field": "dataset", "ignore_failure": true } }, { "rename":{ "field": "message2.event_type", "target_field": "dataset", "ignore_failure": true } }, { "set": { "field": "observer.name", "value": "{{agent.name}}" } }, + { "set": { "field": "ingest.timestamp", "value": "{{@timestamp}}" } }, + { "set": { "field": "@timestamp", "value": "{{message2.timestamp}}" } }, { "remove":{ "field": "agent", "ignore_failure": true } }, { "pipeline": { "name": "suricata.{{dataset}}" } } ]