From b8348f89c2b973b57c96d51d30d9c4856798c283 Mon Sep 17 00:00:00 2001
From: Brian Grabau <brian_grabau@cargill.com>
Date: Fri, 1 Dec 2023 15:19:24 -0600
Subject: [PATCH] flatten citrix message

---
 config/processors/db_audit_citrix.admin.conf   | 4 ++--
 config/processors/db_audit_citrix.session.conf | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/config/processors/db_audit_citrix.admin.conf b/config/processors/db_audit_citrix.admin.conf
index 64265851..4c5a8d69 100644
--- a/config/processors/db_audit_citrix.admin.conf
+++ b/config/processors/db_audit_citrix.admin.conf
@@ -72,8 +72,8 @@ filter {
     locale => "en"
     target => "[event][end]"
   }
-  json_encode {
-    source => "message"
+  ruby {
+    code => 'event.set("message", event.get("message").to_s)'
   }
 }
 output {
diff --git a/config/processors/db_audit_citrix.session.conf b/config/processors/db_audit_citrix.session.conf
index 1ab99edf..677fd81a 100644
--- a/config/processors/db_audit_citrix.session.conf
+++ b/config/processors/db_audit_citrix.session.conf
@@ -58,8 +58,8 @@ filter {
     locale => "en"
     target => "[event][created]"
   }
-  json_encode {
-    source => "message"
+  ruby {
+    code => 'event.set("message", event.get("message").to_s)'
   }
 }
 output {