From 9a4eadc9676f55895ded6bae3dc4cd6d0e164ee6 Mon Sep 17 00:00:00 2001
From: Josh Brower <josh@defensivedepth.com>
Date: Thu, 19 Sep 2019 08:30:33 -0400
Subject: [PATCH] Add rule_signature mapping

---
 salt/logstash/etc/logstash-template.json | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/salt/logstash/etc/logstash-template.json b/salt/logstash/etc/logstash-template.json
index 53c418d39..44e519842 100644
--- a/salt/logstash/etc/logstash-template.json
+++ b/salt/logstash/etc/logstash-template.json
@@ -2675,6 +2675,14 @@
         "rule_number":{
           "type":"long"
         },
+	"rule_signature":{
+          "type":"text",
+          "fields":{
+            "keyword":{
+              "type":"keyword"
+            }
+          }
+        },
         "rule_type":{
           "type":"text",
           "fields":{