From a1e6a85a68bfa638571fd037fb09d7fc1595bd2f Mon Sep 17 00:00:00 2001 From: Doug Burks Date: Tue, 14 Jul 2020 15:49:46 -0400 Subject: [PATCH] explicitly set Suricata timestamp timezone to UTC --- salt/elasticsearch/files/ingest/suricata.common | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/salt/elasticsearch/files/ingest/suricata.common b/salt/elasticsearch/files/ingest/suricata.common index 435f845c1..2bc727012 100644 --- a/salt/elasticsearch/files/ingest/suricata.common +++ b/salt/elasticsearch/files/ingest/suricata.common @@ -13,7 +13,7 @@ { "rename":{ "field": "message2.event_type", "target_field": "dataset", "ignore_failure": true } }, { "set": { "field": "observer.name", "value": "{{agent.name}}" } }, { "set": { "field": "ingest.timestamp", "value": "{{@timestamp}}" } }, - { "set": { "field": "@timestamp", "value": "{{message2.timestamp}}" } }, + { "date": { "field": "message2.timestamp", "target_field": "@timestamp", "formats": ["ISO8601", "UNIX"], "timezone": "UTC", "ignore_failure": true } }, { "remove":{ "field": "agent", "ignore_failure": true } }, { "pipeline": { "name": "suricata.{{dataset}}" } } ]