diff --git a/salt/elasticsearch/files/ingest/logscan b/salt/elasticsearch/files/ingest/logscan
index 9a094f4c6..3a3debabc 100644
--- a/salt/elasticsearch/files/ingest/logscan
+++ b/salt/elasticsearch/files/ingest/logscan
@@ -2,14 +2,17 @@
     "description": "logscan",
     "processors": [
         { "set": { "field": "event.severity", "value": 2 } },
+        { "json": { "field": "message", "add_to_root": true, "ignore_failure": true } },
         { "rename": { "field": "@timestamp", "target_field": "event.ingested", "ignore_missing": true } },
         { "date": { "field": "timestamp", "target_field": "event.created", "formats": [ "ISO8601", "UNIX" ], "ignore_failure": true } },
         { "date": { "field": "start_time", "target_field": "@timestamp", "formats": [ "ISO8601", "UNIX" ], "ignore_failure": true } },
         { "date": { "field": "start_time", "target_field": "event.start", "formats": [ "ISO8601", "UNIX" ], "ignore_failure": true } },
         { "date": { "field": "end_time", "target_field": "event.end", "formats": [ "ISO8601", "UNIX" ], "ignore_failure": true } },
-        { "rename": { "field": "source_ip", "target_field": "source.ip" } },
-        { "append": { "field": "logsscan.source.ips", "value": "{{{source.ip}}}" } },
-        { "rename": { "field": "source_ips", "target_field": "logscan.source.ips" } },
+        { "remove": { "field": "start_time", "ignore_missing": true } },
+        { "remove": { "field": "end_time", "ignore_missing": true } },
+        { "rename": { "field": "source_ip", "target_field": "source.ip", "ignore_missing": true } },
+        { "append": { "field": "logsscan.source.ips", "value": "{{{source.ip}}}", "ignore_failure": true } },
+        { "rename": { "field": "source_ips", "target_field": "logscan.source.ips", "ignore_missing": true } },
         { "set": { "if": "ctx.model == 'kff'", "field": "rule.name", "value": "LOGSCAN KFF MODEL THRESHOLD" } },
         { "set": { "if": "ctx.model == 'kff'", "field": "rule.description", "value": "High ratio of login failures in 5 minute window" } },
         { "set": { "if": "ctx.model == 'kl'", "field": "rule.name", "value": "LOGSCAN KL MODEL THRESHOLD" } },
diff --git a/salt/filebeat/etc/filebeat.yml b/salt/filebeat/etc/filebeat.yml
index 68fc32d7c..f5ba5dc74 100644
--- a/salt/filebeat/etc/filebeat.yml
+++ b/salt/filebeat/etc/filebeat.yml
@@ -114,7 +114,7 @@ filebeat.inputs:
 
 - type: log
   paths:
-    - /opt/so/log/logscan/alerts.log
+    - /logs/logscan/alerts.log
   fields:
     module: logscan
     dataset: alert
diff --git a/salt/logstash/pipelines/config/so/9800_output_logscan.conf.jinja b/salt/logstash/pipelines/config/so/9800_output_logscan.conf.jinja
index a0e5bd570..a1c621484 100644
--- a/salt/logstash/pipelines/config/so/9800_output_logscan.conf.jinja
+++ b/salt/logstash/pipelines/config/so/9800_output_logscan.conf.jinja
@@ -16,7 +16,7 @@ output {
       user => "{{ ES_USER }}"
       password => "{{ ES_PASS }}"
     {% endif %}
-      index => "so-%{[event][module]}"
+      index => "so-logscan"
       template_name => "so-common"
       template => "/templates/so-common-template.json"
       template_overwrite => true