In windows package, forwarded data_stream, the current winlog.yml.hbs has:
processors:
- translate_sid:
field: winlog.event_data.MemberSid
account_name_target: winlog.event_data._MemberUserName
domain_target: winlog.event_data._MemberDomain
account_type_target: winlog.event_data._MemberAccountType
ignore_missing: true
ignore_failure: true
{{#if processors.length}}
{{processors}}
{{/if}}
translate_sid processor needs to be indented like this:
processors:
- translate_sid:
field: winlog.event_data.MemberSid
account_name_target: winlog.event_data._MemberUserName
domain_target: winlog.event_data._MemberDomain
account_type_target: winlog.event_data._MemberAccountType
ignore_missing: true
ignore_failure: true
{{#if processors.length}}
{{processors}}
{{/if}}
If a user specifies a processor, the indentation in the list is inconsistent and policy can't be compiled.
In windows package, forwarded data_stream, the current
winlog.yml.hbshas:translate_sid processor needs to be indented like this: