You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
for f in $(
(
for p in $(
yq 'select(.owner.github == "elastic/security-service-integrations")|.name' packages/**/manifest.yml \
| grep -v -- ---
); do
find packages/$p -name default.yml
done
)|sort|uniq
); do
yq -o=json $f|quatch -l $f -p '{"processors":{"remove":{"field":["event.original"]}}}'
done
This is the security-service-integrations sub issue for #12045.
add preserve_original_event in primary on_failure handlers ssi_all: add "preserve_original_event" tag to documents with event.kind set to "pipeline_error" #12046 google_workspace,jamf_protect,ti_mandiant: add "preserve_original_event" tag to documents with event.kind set to "pipeline_error" #12108
add preserve_original_event in cases of manual setting
event.kindto "pipeline_error" ssi_all: add "preserve_original_event" tag to documents with event.kind manually set to "pipeline_error" #12109ensure no remove event.original processors remain ssi_all: do not remove event.original in main ingest pipeline #12076 okta: do not remove event.original in main ingest #12127
quatch