From a3deb868ad6b5f1a8b1b7601feb084501c9dc4b8 Mon Sep 17 00:00:00 2001
From: Jason Ertel <jason.ertel@securityonionsolutions.com>
Date: Tue, 30 Jun 2020 14:57:34 -0400
Subject: [PATCH] Improve filebeat config indentation

---
 salt/filebeat/etc/filebeat.yml | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/salt/filebeat/etc/filebeat.yml b/salt/filebeat/etc/filebeat.yml
index ac4e0fe6f..9dd00503c 100644
--- a/salt/filebeat/etc/filebeat.yml
+++ b/salt/filebeat/etc/filebeat.yml
@@ -128,9 +128,9 @@ filebeat.inputs:
         imported: true
     processors:
       - dissect:
-        tokenizer: "/nsm/import/%{import_id}/zeek/logs/%{import_source}"
-        field: "source"
-        target_prefix: ""
+          tokenizer: "/nsm/import/%{import_id}/zeek/logs/%{import_source}"
+          field: "source"
+          target_prefix: ""
       - drop_fields:
         fields: ["source", "prospector", "input", "offset", "beat"]
  
@@ -166,9 +166,9 @@ filebeat.inputs:
       imported: true 
     processors:
     - dissect:
-      tokenizer: "/nsm/import/%{import_id}/suricata/%{import_source}"
-      field: "source"
-      target_prefix: ""
+        tokenizer: "/nsm/import/%{import_id}/suricata/%{import_source}"
+        field: "source"
+        target_prefix: ""
     - drop_fields:
         fields: ["source", "prospector", "input", "offset", "beat"]