From b1c09a9b72ffb5b3a88beb42da1e9fd94dcdb8b6 Mon Sep 17 00:00:00 2001 From: Josh Brower Date: Tue, 28 Jul 2020 15:23:17 -0400 Subject: [PATCH] Typo fix - ingest parser - win.eventlogs --- salt/elasticsearch/files/ingest/win.eventlogs | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/salt/elasticsearch/files/ingest/win.eventlogs b/salt/elasticsearch/files/ingest/win.eventlogs index acdf97263..b6022f294 100644 --- a/salt/elasticsearch/files/ingest/win.eventlogs +++ b/salt/elasticsearch/files/ingest/win.eventlogs @@ -1,13 +1,11 @@ { "description" : "win.eventlogs", "processors" : [ - { "set": { "if": "ctx.winlog?.channel != null", "field": "event.module", "value": "windows_eventlog", "override": false, "ignore_failure": true } }, { "set": { "if": "ctx.agent?.type != null", "field": "module", "value": "{{agent.type}}", "override": true } }, { "set": { "if": "ctx.winlog?.channel != null", "field": "event.dataset", "value": "{{winlog.channel}}", "override": true } }, { "rename": { "field": "agent.hostname", "target_field": "agent.name", "ignore_missing": true } }, - { "rename": { "field": "winlog.event_data.SubjectUserName", "target_field": "user.name", "ignore_missing": true } }, - { "rename": { "field": "winlog.event_data.User", "target_field": "user.name", "ignore_missing": true } }, + { "rename": { "field": "winlog.event_data.User", "target_field": "user.name", "ignore_missing": true } } ] -} \ No newline at end of file +}