CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-21 16:33:08 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #1522 from Security-Onion-Solutions/fix/pipeline_commmon_remove_ignore_missing

Browse Source 
Fix common pipeline field removal so won't fail for missing fields
This commit is contained in:
weslambert
2020-10-14 09:56:34 -04:00
committed by GitHub
parent a106913d1a 3c820365ab
commit 8d4fd6c18d
1 changed files with 1 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
salt/elasticsearch/files/ingest/common
View File

@@ -37,7 +37,7 @@
{ "convert": { "field": "log.id.uid", "type": "string", "ignore_failure": true, "ignore_missing": true } },
{ "convert": { "field": "agent.id", "type": "string", "ignore_failure": true, "ignore_missing": true } },
{ "convert": { "field": "event.severity", "type": "integer", "ignore_failure": true, "ignore_missing": true } },
{ "remove": { "field": [ "message2", "type", "fields" ], "ignore_failure": true } },
{ "remove": { "field": [ "message2", "type", "fields", "category", "module", "dataset" ], "ignore_missing": true, "ignore_failure": true } },
{
"date_index_name": {
"field": "@timestamp",
@@ -48,6 +48,4 @@
}
}
]
}
]
}