From 50c03b927edea826fab7c89df12f9bcee8e37ade Mon Sep 17 00:00:00 2001 From: Brian Grabau Date: Mon, 30 Sep 2024 09:24:26 -0500 Subject: [PATCH] removed field with wrong data in cisco router --- config/processors/syslog_audit_cisco.router.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/processors/syslog_audit_cisco.router.conf b/config/processors/syslog_audit_cisco.router.conf index 7ec7d3b8..f1df9ae3 100644 --- a/config/processors/syslog_audit_cisco.router.conf +++ b/config/processors/syslog_audit_cisco.router.conf @@ -101,7 +101,7 @@ filter { tag_on_failure => "_dateparsefailure_ei" } mutate { - remove_field => [ "[tmp]", "[log][syslog]", "[observer][egress]", "[observer][ingress]" ] + remove_field => [ "[tmp]", "[log][syslog]", "[observer]" ] } } output {