remove _timestamp correctly

2019-04-15 20:12:28 +10:00
parent 97d2a2606c
commit dd66414fe7
3 changed files with 3 additions and 3 deletions
--- a/resources/elk6/pipeline/1000_nessus_process_file.conf
+++ b/resources/elk6/pipeline/1000_nessus_process_file.conf
@ -30,7 +30,7 @@ filter {
    date {
      match => [ "_timestamp", "UNIX" ]
      target => "@timestamp"
-      remove_field => ["timestamp"]
+      remove_field => ["_timestamp"]
    }

    #If using filebeats as your source, you will need to replace the "path" field to "source"