don't use reserved _timestamp

2019-04-22 11:18:49 +10:00
parent 7c2aa54156
commit 8d59831855
4 changed files with 12 additions and 18 deletions
--- a/resources/elk6/pipeline/2000_qualys_web_scans.conf
+++ b/resources/elk6/pipeline/2000_qualys_web_scans.conf
@ -20,9 +20,9 @@ input {
 filter {
  if "qualys" in [tags] {
    date {
-      match => [ "_timestamp", "UNIX" ]
+      match => [ "scan_time", "UNIX" ]
      target => "@timestamp"
-      remove_field => ["_timestamp"]
+      remove_field => ["scan_time"]
    }

    grok {