trying to fix event.dataset missing field

Cargill · Aug 2, 2024 · 17b698c · 17b698c
1 parent 6a4ec68
commit 17b698c
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/config/processors/syslog_security_skyhigh.swg.conf b/config/processors/syslog_security_skyhigh.swg.conf
@@ -9,7 +9,7 @@ input {
 }
 filter {
   mutate {
-    remove_field => [ "host","event" ]
+
     add_field => { "[event][module]" => "skyhigh" }
     add_field => { "[event][dataset]" => "skyhigh.swg" }
     copy => { "message" => "[event][original]" }