removed field with wrong data in cisco router

Cargill · Sep 30, 2024 · 50c03b9 · 50c03b9
1 parent bdfb49d
commit 50c03b9
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/config/processors/syslog_audit_cisco.router.conf b/config/processors/syslog_audit_cisco.router.conf
@@ -101,7 +101,7 @@ filter {
     tag_on_failure => "_dateparsefailure_ei"
   }
   mutate {
-    remove_field => [ "[tmp]", "[log][syslog]", "[observer][egress]", "[observer][ingress]" ]
+    remove_field => [ "[tmp]", "[log][syslog]", "[observer]" ]
   }
 }
 output {