Remove duplicate processor from o365beat.yml

[ghost]

Removed the duplicate processor statement which prevented the augmentation from working and moved the first processor statement into the processor section.

This meant no processing was taking place except the default add host metadata and cloud metadata.

[chris-counteractive]

Thanks for the PR!

This is definitely true: the second processor section "shadows" the first, and has to be removed or merged before use. The problem is, when building the beat the build tools actually create o365beat.yml dynamically by merging _meta/beat.yml with a config file template within the libbeat framework (libbeat/_meta/config.yml.tmpl). It's that .tmpl file that has the extra processor section, and I haven't had time to figure out how to suppress the inclusion of that section. Instead I do what you did in the PR, which is combine them or remove the second processors section altogether.

Unfortunately, if I merge this, it'll be clobbered by the build for the next release and I'll have to re-insert it by hand, which may be the best bet until we sort out a durable fix. Any thoughts on how to suppress the inclusion of the processors section from the libbeat template would be much appreciated! Or, if there's a smarter way to think about the issue, I'm happy to hear that too.

Thanks again for the contribution, I really appreciate the engagement, I'm sure we can sort out a long-term fix for what is definitely a real issue and inconvenience.

[ghost]

I didn't know about the Libbeat template file. That made me read up a little bit more on making custom beats, and I didn't see how to do that yet.

If I find anything I'll let you know and I completely understand why you shouldn't merge this.