Moving all parsed key/value fields into a nested field called 'sd'.

SpringerPE · Dec 19, 2018 · 03f805d · 03f805d
1 parent e18c199
commit 03f805d
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/manifest/operations/pipelines/cf-platform-es/filter-10-syslog_rfc5424_parsing.conf b/manifest/operations/pipelines/cf-platform-es/filter-10-syslog_rfc5424_parsing.conf
@@ -53,7 +53,7 @@ filter {
       kv {
         # Convert the structured data into fields
         source => "syslog5424_sd"
-        prefix => "sd_"
+        target => "sd"
         remove_field => [ "syslog5424_sd" ]
         trim_key => "\["
         trim_value => "\]"