From 7999810d28c08e768cbb0a62a791896138fc5b93 Mon Sep 17 00:00:00 2001
From: pemontto <pemontto@gmail.com>
Date: Mon, 22 Apr 2019 13:48:25 +1000
Subject: [PATCH] fix qualys logstash conditionals

---
 resources/elk6/pipeline/2000_qualys_web_scans.conf | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/resources/elk6/pipeline/2000_qualys_web_scans.conf b/resources/elk6/pipeline/2000_qualys_web_scans.conf
index 652e48a..bde33f4 100644
--- a/resources/elk6/pipeline/2000_qualys_web_scans.conf
+++ b/resources/elk6/pipeline/2000_qualys_web_scans.conf
@@ -26,7 +26,7 @@ input {
 }
 
 filter {
-  if "qualys" in [tags] {
+  if "qualys_vuln" in [tags] or "qualys_web" in  [tags] {
     date {
       match => [ "scan_time", "UNIX" ]
       target => "@timestamp"
@@ -82,7 +82,7 @@ filter {
   }
 }
 output {
-  if "qualys" in [tags] {
+  if "qualys_vuln" in [tags] or "qualys_web" in  [tags] {
     stdout {
       codec => dots
     }