move removed tmp field up in Azure interactive signon

Cargill · Oct 24, 2024 · 3623fdd · 3623fdd
1 parent f7aa32c
commit 3623fdd
Showing 1 changed file with 4 additions and 1 deletion.
diff --git a/config/processors/event_hub_audit_azure.event_hub_interactive_signin.conf b/config/processors/event_hub_audit_azure.event_hub_interactive_signin.conf
@@ -24,6 +24,9 @@ filter {
       field => "[tmp][records]"
       target => "az"
     }
+    mutate {
+      remove_field => [ "tmp" ]    
+    }
     mutate {
       replace => { "message" => "%{az}" }
     }
@@ -230,7 +233,7 @@ filter {
   }
   # 
   mutate {
-    remove_field => [ "tmp", "az" ]    
+    remove_field => [ "az" ]    
   }
 }
 output {