From fc3273fa49a8e5dc192c78bb1ec5906a13b20ba3 Mon Sep 17 00:00:00 2001 From: weslambert Date: Fri, 4 Mar 2022 16:29:01 -0500 Subject: [PATCH] Change to label fields to comply with what's defined in Filebeat template --- salt/elasticsearch/files/ingest/zeek.syslog | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/salt/elasticsearch/files/ingest/zeek.syslog b/salt/elasticsearch/files/ingest/zeek.syslog index e32b89c7e..5bdbd9736 100644 --- a/salt/elasticsearch/files/ingest/zeek.syslog +++ b/salt/elasticsearch/files/ingest/zeek.syslog @@ -4,8 +4,8 @@ { "remove": { "field": ["host"], "ignore_failure": true } }, { "json": { "field": "message", "target_field": "message2", "ignore_failure": true } }, { "rename": { "field": "message2.proto", "target_field": "network.protocol", "ignore_missing": true } }, - { "rename": { "field": "message2.facility", "target_field": "syslog.facility", "ignore_missing": true } }, - { "rename": { "field": "message2.severity", "target_field": "syslog.severity", "ignore_missing": true } }, + { "rename": { "field": "message2.facility", "target_field": "syslog.facility_label", "ignore_missing": true } }, + { "rename": { "field": "message2.severity", "target_field": "syslog.severity_label", "ignore_missing": true } }, { "remove": { "field": "message", "ignore_failure": true } }, { "rename": { "field": "message2.message", "target_field": "message", "ignore_missing": true } }, { "pipeline": { "name": "zeek.common" } }