Osquerybeat: set the raw index name to supress the timestamp suffix (#…

…26545) (#26549) (cherry picked from commit 67cf2c6) Co-authored-by: Aleksandr Maus <[email protected]>
elastic · Jun 29, 2021 · 3de67ff · 3de67ff
1 parent 7de4b31
commit 3de67ff
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/x-pack/osquerybeat/beater/osquerybeat.go b/x-pack/osquerybeat/beater/osquerybeat.go
@@ -19,6 +19,7 @@ import (
 	"golang.org/x/sync/errgroup"
 
 	"github.com/elastic/beats/v7/libbeat/beat"
+	"github.com/elastic/beats/v7/libbeat/beat/events"
 	"github.com/elastic/beats/v7/libbeat/common"
 	"github.com/elastic/beats/v7/libbeat/logp"
 	"github.com/elastic/beats/v7/libbeat/processors"
@@ -430,7 +431,7 @@ func (bt *osquerybeat) publishEvents(index, actionID, responseID string, hits []
 			event.Fields["response_id"] = responseID
 		}
 		if index != "" {
-			event.Meta = common.MapStr{"index": index}
+			event.Meta = common.MapStr{events.FieldMetaRawIndex: index}
 		}
 
 		bt.client.Publish(event)