From 6166fef49247e896d19728493f533242c3634045 Mon Sep 17 00:00:00 2001
From: MehmedSalihbasic <mehmed_salihbasic@cargill.com>
Date: Fri, 27 Sep 2024 09:40:09 -0500
Subject: [PATCH] cisco_router_fix

---
 config/processors/syslog_audit_cisco.router.conf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/config/processors/syslog_audit_cisco.router.conf b/config/processors/syslog_audit_cisco.router.conf
index 05369f1b..7ec7d3b8 100644
--- a/config/processors/syslog_audit_cisco.router.conf
+++ b/config/processors/syslog_audit_cisco.router.conf
@@ -101,7 +101,7 @@ filter {
     tag_on_failure => "_dateparsefailure_ei"
   }
   mutate {
-    remove_field => [ "[tmp]"]
+    remove_field => [ "[tmp]", "[log][syslog]", "[observer][egress]", "[observer][ingress]" ]
   }
 }
 output {