add event.dataset since there are other datasets in soc logs

salt/soc/defaults.yaml

@@ -1273,6 +1273,7 @@ soc:
         - observer.ip
       ':soc:':
         - soc_timestamp
+        - event.dataset
         - source.ip
         - soc.fields.requestMethod
         - soc.fields.requestPath