work in progress for idaholab#395, malcolm reporting capture statisti…

…cs from zeek/suricata
mmguero-dev · Feb 7, 2024 · 6f1c260 · 6f1c260
1 parent 2b0c42e
commit 6f1c260
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/logstash/pipelines/zeek/12_zeek_mutate.conf b/logstash/pipelines/zeek/12_zeek_mutate.conf
@@ -2485,7 +2485,7 @@ filter {
     mutate { id => "mutate_add_field_ecs_event_kind_alert"
              add_field => { "[event][kind]" => "alert" } }
   } else if ("_zeekdiagnostic" in [tags]) and ([zeek][stats]) {
-    mutate { id => "mutate_add_field_ecs_event_kind_event"
+    mutate { id => "mutate_add_field_ecs_event_kind_metric"
              add_field => { "[event][kind]" => "metric" } }
   } else {
     mutate { id => "mutate_add_field_ecs_event_kind_event"