From e7a6172d7e439d2d2fe4adfe951e8b84e2d23720 Mon Sep 17 00:00:00 2001 From: William Wernert Date: Tue, 13 Jul 2021 14:07:27 -0400 Subject: [PATCH] [fix] Add single quotes to strings --- salt/elasticsearch/files/ingest/logscan | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/salt/elasticsearch/files/ingest/logscan b/salt/elasticsearch/files/ingest/logscan index d199161a5..9a094f4c6 100644 --- a/salt/elasticsearch/files/ingest/logscan +++ b/salt/elasticsearch/files/ingest/logscan @@ -10,10 +10,10 @@ { "rename": { "field": "source_ip", "target_field": "source.ip" } }, { "append": { "field": "logsscan.source.ips", "value": "{{{source.ip}}}" } }, { "rename": { "field": "source_ips", "target_field": "logscan.source.ips" } }, - { "set": { "if": "ctx.model == kff", "field": "rule.name", "value": "LOGSCAN KFF MODEL THRESHOLD" } }, - { "set": { "if": "ctx.model == kff", "field": "rule.description", "value": "High ratio of login failures in 5 minute window" } }, - { "set": { "if": "ctx.model == kl", "field": "rule.name", "value": "LOGSCAN KL MODEL THRESHOLD" } }, - { "set": { "if": "ctx.model == kl", "field": "rule.description", "value": "Large number of login failures in 1 hour window" } }, + { "set": { "if": "ctx.model == 'kff'", "field": "rule.name", "value": "LOGSCAN KFF MODEL THRESHOLD" } }, + { "set": { "if": "ctx.model == 'kff'", "field": "rule.description", "value": "High ratio of login failures in 5 minute window" } }, + { "set": { "if": "ctx.model == 'kl'", "field": "rule.name", "value": "LOGSCAN KL MODEL THRESHOLD" } }, + { "set": { "if": "ctx.model == 'kl'", "field": "rule.description", "value": "Large number of login failures in 1 hour window" } }, { "rename": { "field": "model", "target_field": "logscan.model" } }, { "rename": { "field": "num_attempts", "target_field": "logscan.attempts.total.amount", "ignore_missing": true } }, { "rename": { "field": "num_failed", "target_field": "logscan.attempts.failed.amount", "ignore_missing": true } },