Added replayc message after split in Azure singin logs

Cargill · Oct 24, 2024 · c0ea456 · c0ea456
1 parent c763dd8
commit c0ea456
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/config/processors/event_hub_audit_azure.event_hub_interactive_signin.conf b/config/processors/event_hub_audit_azure.event_hub_interactive_signin.conf
@@ -24,6 +24,12 @@ filter {
       field => "[tmp][records]"
       target => "az"
     }
+    mutate {
+      replace => { "message" => "%{az}" }
+    }
+    json_encode {
+      source => "message"
+    }
   } else {
     mutate {
       rename => { "tmp" => "az"}