fix qualys logstash conditionals

2019-04-22 13:48:25 +10:00
parent 50f4d76fec
commit 7999810d28
1 changed files with 2 additions and 2 deletions
--- a/resources/elk6/pipeline/2000_qualys_web_scans.conf
+++ b/resources/elk6/pipeline/2000_qualys_web_scans.conf
@ -26,7 +26,7 @@ input {
 }

 filter {
-  if "qualys" in [tags] {
+  if "qualys_vuln" in [tags] or "qualys_web" in  [tags] {
    date {
      match => [ "scan_time", "UNIX" ]
      target => "@timestamp"
@ -82,7 +82,7 @@ filter {
  }
 }
 output {
-  if "qualys" in [tags] {
+  if "qualys_vuln" in [tags] or "qualys_web" in  [tags] {
    stdout {
      codec => dots
    }