updated extract filter

duplocloud · Nov 28, 2024 · 9c64d0f · 9c64d0f
1 parent 4c47b82
commit 9c64d0f
Showing 1 changed file with 7 additions and 2 deletions.
diff --git a/diagnostics/opensearch/logstash/logstash.conf b/diagnostics/opensearch/logstash/logstash.conf
@@ -16,15 +16,20 @@ filter {
 
   date {
     match => ["[records][time]", "MM/dd/yyyy HH:mm:ss"]
-    target => "@timestamp"
+    target => "creation_time"
   }
 
   mutate {
     remove_field => ["[records][time]"]
   }
 
   mutate {
-    remove_field => ["event.original"]
+    remove_field => ["[event][original]"]
+  }
+
+  json {
+    source => ["[records][properties]"]
+    remove_field => ["[records][properties]"]
   }
 }