Merge pull request #551 from Cargill/azure_interactive_msg

Added replayc message after split in Azure singin logs
Cargill · Oct 24, 2024 · f7aa32c · f7aa32c
2 parents c763dd8 + c0ea456
commit f7aa32c
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/config/processors/event_hub_audit_azure.event_hub_interactive_signin.conf b/config/processors/event_hub_audit_azure.event_hub_interactive_signin.conf
@@ -24,6 +24,12 @@ filter {
       field => "[tmp][records]"
       target => "az"
     }
+    mutate {
+      replace => { "message" => "%{az}" }
+    }
+    json_encode {
+      source => "message"
+    }
   } else {
     mutate {
       rename => { "tmp" => "az"}