Merge pull request #543 from Cargill/cisco_observer

Removed field with wrong data in cisco router
Cargill · Sep 30, 2024 · adb4408 · adb4408
2 parents bdfb49d + 50c03b9
commit adb4408
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/config/processors/syslog_audit_cisco.router.conf b/config/processors/syslog_audit_cisco.router.conf
@@ -101,7 +101,7 @@ filter {
     tag_on_failure => "_dateparsefailure_ei"
   }
   mutate {
-    remove_field => [ "[tmp]", "[log][syslog]", "[observer][egress]", "[observer][ingress]" ]
+    remove_field => [ "[tmp]", "[log][syslog]", "[observer]" ]
   }
 }
 output {