Set ecs.version in pipeline

adriansr · adriansr · commit bf9ba873efd3 · 2021-05-12T15:51:30.000+02:00
diff --git a/packages/cyberarkpas/data_stream/audit/agent/stream/log.yml.hbs b/packages/cyberarkpas/data_stream/audit/agent/stream/log.yml.hbs
@@ -15,7 +15,3 @@ publisher_pipeline.disable_host: true
 {{/contains}}
 processors:
   - add_locale: ~
-  - add_fields:
-      target: ''
-      fields:
-        ecs.version: 1.9.0
diff --git a/packages/cyberarkpas/data_stream/audit/agent/stream/tcp.yml.hbs b/packages/cyberarkpas/data_stream/audit/agent/stream/tcp.yml.hbs
@@ -15,7 +15,3 @@ ssl: {{ssl}}
 {{/if}}
 processors:
   - add_locale: ~
-  - add_fields:
-      target: ''
-      fields:
-        ecs.version: 1.9.0
diff --git a/packages/cyberarkpas/data_stream/audit/agent/stream/udp.yml.hbs b/packages/cyberarkpas/data_stream/audit/agent/stream/udp.yml.hbs
@@ -10,10 +10,5 @@ tags:
 {{#contains tags "forwarded"}}
 publisher_pipeline.disable_host: true
 {{/contains}}
-
 processors:
   - add_locale: ~
-  - add_fields:
-      target: ''
-      fields:
-        ecs.version: 1.9.0
diff --git a/packages/cyberarkpas/data_stream/audit/elasticsearch/ingest_pipeline/default.yml b/packages/cyberarkpas/data_stream/audit/elasticsearch/ingest_pipeline/default.yml
@@ -3,11 +3,14 @@ description: Pipeline for CyberArk PAS
 
 processors:
   #
-  # Set ECS event.ingested
+  # Set ECS version and event.ingested
   #
   - set:
-        field: event.ingested
-        value: '{{{_ingest.timestamp}}}'
+      field: event.ingested
+      value: '{{{_ingest.timestamp}}}'
+  - set:
+      field: ecs.version
+      value: 1.9.0
 
   #
   # Set event.original from message, unless reindexing.

Original file line number	Diff line number	Diff line change
`@@ -3,11 +3,14 @@ description: Pipeline for CyberArk PAS`
`3`	`3`
`4`	`4`	`processors:`
`5`	`5`	`#`
`6`		`- # Set ECS event.ingested`
	`6`	`+ # Set ECS version and event.ingested`
`7`	`7`	`#`
`8`	`8`	`- set:`
`9`		`- field: event.ingested`
`10`		`- value: '{{{_ingest.timestamp}}}'`
	`9`	`+ field: event.ingested`
	`10`	`+ value: '{{{_ingest.timestamp}}}'`
	`11`	`+ - set:`
	`12`	`+ field: ecs.version`
	`13`	`+ value: 1.9.0`
`11`	`14`
`12`	`15`	`#`
`13`	`16`	`# Set event.original from message, unless reindexing.`