fix qualys logstash conditionals
This commit is contained in:
@ -26,7 +26,7 @@ input {
|
|||||||
}
|
}
|
||||||
|
|
||||||
filter {
|
filter {
|
||||||
if "qualys" in [tags] {
|
if "qualys_vuln" in [tags] or "qualys_web" in [tags] {
|
||||||
date {
|
date {
|
||||||
match => [ "scan_time", "UNIX" ]
|
match => [ "scan_time", "UNIX" ]
|
||||||
target => "@timestamp"
|
target => "@timestamp"
|
||||||
@ -82,7 +82,7 @@ filter {
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
output {
|
output {
|
||||||
if "qualys" in [tags] {
|
if "qualys_vuln" in [tags] or "qualys_web" in [tags] {
|
||||||
stdout {
|
stdout {
|
||||||
codec => dots
|
codec => dots
|
||||||
}
|
}
|
||||||
|
Reference in New Issue
Block a user