diff --git a/config/processors/log_cdp_hadoop.conf b/config/processors/log_hadoop.conf similarity index 92% rename from config/processors/log_cdp_hadoop.conf rename to config/processors/log_hadoop.conf index a1c3e3ed..021c1682 100644 --- a/config/processors/log_cdp_hadoop.conf +++ b/config/processors/log_hadoop.conf @@ -8,8 +8,8 @@ input { } filter { mutate { - add_field => { "[event][module]" => "cdp" } - add_field => { "[event][dataset]" => "cdp.hadoop" } + add_field => { "[event][module]" => "hadoop" } + add_field => { "[event][dataset]" => "hadoop.agent" } rename => { "[beat][hostname]" => "[log][source][hostname]" } update => { "message" => "%{[event][original]}" } remove_tag => [ "hadoop-log4j", "jobhistory", "beats", "beats_input_codec_plain_applied", "siem-kafka" ] diff --git a/config/processors/log_cdp_tanium.conf b/config/processors/log_rundeck.conf similarity index 91% rename from config/processors/log_cdp_tanium.conf rename to config/processors/log_rundeck.conf index 88f7c711..9d580bd7 100644 --- a/config/processors/log_cdp_tanium.conf +++ b/config/processors/log_rundeck.conf @@ -8,8 +8,8 @@ input { } filter { mutate { - add_field => { "[event][module]" => "cdp" } - add_field => { "[event][dataset]" => "cdp.tanium" } + add_field => { "[event][module]" => "rundeck" } + add_field => { "[event][dataset]" => "rundeck.agent" } copy => { "[beat][hostname]" => "[log][source][hostname]" } update => { "message" => "[event][original]" } } diff --git a/config/processors/log_cdp_rundeck.conf b/config/processors/log_tanium.conf similarity index 92% rename from config/processors/log_cdp_rundeck.conf rename to config/processors/log_tanium.conf index 92c7717d..9eac6bff 100644 --- a/config/processors/log_cdp_rundeck.conf +++ b/config/processors/log_tanium.conf @@ -8,8 +8,8 @@ input { } filter { mutate { - add_field => { "[event][module]" => "cdp" } - add_field => { "[event][dataset]" => "cdp.rundeck" } + add_field => { "[event][module]" => "tanium" } + add_field => { "[event][dataset]" => "tanium.agent" } copy => { "[beat][hostname]" => "[log][source][hostname]" } update => { "message" => "[event][original]" } }