don't use reserved _timestamp
This commit is contained in:
@ -28,9 +28,9 @@ filter {
|
||||
if "nessus" in [tags] or "tenable" in [tags] {
|
||||
|
||||
date {
|
||||
match => [ "_timestamp", "UNIX" ]
|
||||
match => [ "scan_time", "UNIX" ]
|
||||
target => "@timestamp"
|
||||
remove_field => ["_timestamp"]
|
||||
remove_field => ["scan_time"]
|
||||
}
|
||||
|
||||
#If using filebeats as your source, you will need to replace the "path" field to "source"
|
||||
|
Reference in New Issue
Block a user