From d823d5dcc90b818ec73c57e8e8651e54066ae8aa Mon Sep 17 00:00:00 2001
From: Wes <wlambertts@gmail.com>
Date: Wed, 19 Apr 2023 20:17:10 +0000
Subject: [PATCH] Rename @metadata to metadata to ensure it's not lost between
 Logstash pipelines

---
 .../pipelines/config/so/0012_input_elastic_agent.conf        | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/salt/logstash/pipelines/config/so/0012_input_elastic_agent.conf b/salt/logstash/pipelines/config/so/0012_input_elastic_agent.conf
index 2cb31ed45..d8c420bcd 100644
--- a/salt/logstash/pipelines/config/so/0012_input_elastic_agent.conf
+++ b/salt/logstash/pipelines/config/so/0012_input_elastic_agent.conf
@@ -10,3 +10,8 @@ input {
     ecs_compatibility => v8
   }
 }
+filter {
+  mutate {
+    rename => {"@metadata" => "metadata"}
+  }
+}