From 8c7767b381462ae911abd7844e9261475c4b3bec Mon Sep 17 00:00:00 2001
From: Josh Brower <josh@defensivedepth.com>
Date: Fri, 3 Nov 2023 08:41:33 -0400
Subject: [PATCH] Dont overwrite metadata

---
 .../pipelines/config/so/0012_input_elastic_agent.conf.jinja    | 3 +++
 .../pipelines/config/so/0013_input_lumberjack_fleet.conf       | 3 ++-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/salt/logstash/pipelines/config/so/0012_input_elastic_agent.conf.jinja b/salt/logstash/pipelines/config/so/0012_input_elastic_agent.conf.jinja
index 035436a96..6ba29f8e5 100644
--- a/salt/logstash/pipelines/config/so/0012_input_elastic_agent.conf.jinja
+++ b/salt/logstash/pipelines/config/so/0012_input_elastic_agent.conf.jinja
@@ -11,7 +11,10 @@ input {
   }
 }
 filter {
+if ![metadata] {
   mutate {
     rename => {"@metadata" => "metadata"}
   }
 }
+}
+
diff --git a/salt/logstash/pipelines/config/so/0013_input_lumberjack_fleet.conf b/salt/logstash/pipelines/config/so/0013_input_lumberjack_fleet.conf
index 0377a81c4..fd9a87a22 100644
--- a/salt/logstash/pipelines/config/so/0013_input_lumberjack_fleet.conf
+++ b/salt/logstash/pipelines/config/so/0013_input_lumberjack_fleet.conf
@@ -13,10 +13,11 @@ input {
 
 
 filter {
-  if "fleet-lumberjack-input" in [tags] {
+if ![metadata] {
   mutate {
     rename => {"@metadata" => "metadata"}
   }
 }
 }
 
+