Use override to avoid using a script expression

elastic · Aug 8, 2023 · 6b11263 · 6b11263
1 parent dd00a5c
commit 6b11263
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/packages/gcp/data_stream/audit/elasticsearch/ingest_pipeline/default.yml b/packages/gcp/data_stream/audit/elasticsearch/ingest_pipeline/default.yml
@@ -313,7 +313,7 @@ processors:
   - set:
       field: event.outcome
       value: unknown
-      if: ctx?.event?.outcome == null
+      override: false
 
 ##
 # if gcp.audit.authorization_info.[0].granted is true then