From eacd3c9bfd13886f7119fba0732a1b09909b753a Mon Sep 17 00:00:00 2001 From: Wes Lambert Date: Tue, 31 Mar 2020 00:36:42 +0000 Subject: [PATCH] update zeek.common --- salt/elasticsearch/files/ingest/zeek.common | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/salt/elasticsearch/files/ingest/zeek.common b/salt/elasticsearch/files/ingest/zeek.common index 4c062c1c3..88949353c 100644 --- a/salt/elasticsearch/files/ingest/zeek.common +++ b/salt/elasticsearch/files/ingest/zeek.common @@ -16,7 +16,7 @@ { "rename": { "field": "message2.id.resp_p", "target_field": "destination.port", "ignore_missing": true } }, { "set": { "field": "server.port", "value": "{{destination.port}}" } }, { "date": { "field": "message2.ts", "target_field": "@timestamp", "formats": ["ISO8601", "UNIX"], "ignore_failure": true } }, - { "remove": { "field": ["message2.ts", "path", "agent"], "ignore_failure": true } }, + { "remove": { "field": ["agent"], "ignore_failure": true } }, { "pipeline": { "name": "common" } } ] }