securityonion/salt/elasticsearch/files/ingest/logs-system.auth@custom

{
    "version": 1,
    "_meta": {
        "managed_by": "securityonion",
        "managed": true
    },
    "description": "Custom pipeline for the System integration's auth data stream.",
    "processors": [
        {
            "trim": {
                "description": "Grok leaves a leading space on 'invalid user' names (elastic/integrations#12174) and, before 2.23.2, sudo padding",
                "field": "user.name",
                "ignore_missing": true,
                "ignore_failure": true
            }
        },
        {
            "trim": {
                "description": "Appended from the untrimmed user.name",
                "field": "related.user",
                "ignore_missing": true,
                "ignore_failure": true
            }
        },
        {
            "script": {
                "description": "Dedupe after trimming",
                "if": "ctx.related?.user instanceof List",
                "source": "ctx.related.user = new ArrayList(new LinkedHashSet(ctx.related.user));",
                "ignore_failure": true
            }
        }
    ]
}