added log.original

Cargill · Jun 13, 2024 · 8101cbd · 8101cbd
1 parent ae0dda0
commit 8101cbd
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/config/processors/event_hub_audit_azure.event_hub_interactive_signin.conf b/config/processors/event_hub_audit_azure.event_hub_interactive_signin.conf
@@ -30,6 +30,7 @@ filter {
     add_field => { "[event][module]" => "azure" }
     add_field => { "[event][dataset]" => "azure.interactivesignin" }
     add_field => { "[log][source][hostname]" => "%{[az][TenantId]}" }
+    copy => { "message" => "[log][original]" }
   }
   mutate {
     rename => { "[az][TenantId]" => "[cloud][account][id]" }