diff --git a/salt/elasticsearch/files/ingest/common b/salt/elasticsearch/files/ingest/common index 3fb02a3bb..e63a575f9 100644 --- a/salt/elasticsearch/files/ingest/common +++ b/salt/elasticsearch/files/ingest/common @@ -38,9 +38,10 @@ { "rename": { "field": "module", "target_field": "event.module", "ignore_missing": true } }, { "rename": { "field": "dataset", "target_field": "event.dataset", "ignore_missing": true } }, { "rename": { "field": "category", "target_field": "event.category", "ignore_missing": true } }, + { "rename": { "field": "message2.community_id", "target_field": "network.community_id", "ignore_missing": true } }, { "remove": { - "field": [ "index_name_prefix"], + "field": [ "index_name_prefix", "message2"], "ignore_failure": false } } diff --git a/salt/elasticsearch/files/ingest/suricata.common b/salt/elasticsearch/files/ingest/suricata.common index 52d9372a2..c5009f31e 100644 --- a/salt/elasticsearch/files/ingest/suricata.common +++ b/salt/elasticsearch/files/ingest/suricata.common @@ -3,12 +3,12 @@ "processors" : [ { "rename":{ "field": "message2.proto", "target_field": "network.transport", "ignore_failure": true } }, { "rename":{ "field": "message2.flow_id", "target_field": "event.id", "ignore_failure": true } }, - { "rename":{ "field": "message2.comunity_id", "target_field": "network.comunity_id", "ignore_failure": true } }, { "rename":{ "field": "message2.src_ip", "target_field": "source.ip", "ignore_failure": true } }, { "rename":{ "field": "message2.src_port", "target_field": "source.port", "ignore_failure": true } }, { "rename":{ "field": "message2.dest_ip", "target_field": "destination.ip", "ignore_failure": true } }, { "rename":{ "field": "message2.dest_port", "target_field": "destination.port", "ignore_failure": true } }, - { "remove": { "field": ["message2", "agent"], "ignore_failure": true } }, + { "rename": { "field": "message2.community_id", "target_field": "network.community_id", "ignore_missing": true } }, + { "remove": { "field": ["agent"], "ignore_failure": true } }, { "pipeline": { "name": "common" } } ] }