Remove system.syslog.timestamp

elastic · Nov 22, 2018 · 712d3bd · 712d3bd
1 parent 7e99526
commit 712d3bd
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 6 deletions.
diff --git a/filebeat/module/system/syslog/ingest/pipeline.json b/filebeat/module/system/syslog/ingest/pipeline.json
@@ -37,6 +37,11 @@
                 {< if .convert_timezone >}"timezone": "{{ beat.timezone }}",{< end >}
                 "ignore_failure": true
             }
+        },
+        {
+            "remove": {
+                "field": "system.syslog.timestamp"
+            }
         }
     ],
     "on_failure" : [{

diff --git a/filebeat/module/system/syslog/test/darwin-syslog-sample.log-expected.json b/filebeat/module/system/syslog/test/darwin-syslog-sample.log-expected.json
@@ -11,8 +11,7 @@
         "log.offset": 0, 
         "message": "2016-12-13 11:35:28.420 GoogleSoftwareUpdateAgent[21412/0x700007399000] [lvl=2] -[KSAgentApp updateProductWithProductID:usingEngine:] Checking for updates for \"All Products\" using engine <KSUpdateEngine:0x100341a00\n\t\tticketStore=<KSPersistentTicketStore:0x100204520 store=<KSKeyedPersistentStore:0x100213290\n\t\t\tpath=\"/Users/tsg/Library/Google/GoogleSoftwareUpdate/TicketStore/Keystone.ticketstore\"\n\t\t\tlockFile=<KSLockFile:0x1002160e0\n\t\t\t\tpath=\"/Users/tsg/Library/Google/GoogleSoftwareUpdate/TicketStore/Keystone.ticketstore.lock\"\n\t\t\t\tlocked=NO\n\t\t\t>\n\t\t>>\n\t\tprocessor=<KSActionProcessor:0x1003bb5f0\n\t\t\tdelegate=<KSUpdateEngine:0x100341a00>\n\t\t\tisProcessing=NO actionsCompleted=0 progress=0.00\n\t\t\terrors=0 currentActionErrors=0\n\t\t\tevents=0 currentActionEvents=0\n\t\t\tactionQueue=( )\n\t\t>\n\t\tdelegate=(null)\n\t\tserverInfoStore=(null)\n\t\terrors=0\n\t>", 
         "process.name": "GoogleSoftwareUpdateAgent", 
-        "process.pid": 21412, 
-        "system.syslog.timestamp": "Dec 13 11:35:28"
+        "process.pid": 21412
     }, 
     {
         "@timestamp": "2018-12-13T11:35:28.000Z", 
@@ -23,16 +22,14 @@
         "log.offset": 907, 
         "message": "2016-12-13 11:35:28.421 GoogleSoftwareUpdateAgent[21412/0x700007399000] [lvl=2] -[KSUpdateEngine updateAllExceptProduct:] KSUpdateEngine updating all installed products, except:'com.google.Keystone'.", 
         "process.name": "GoogleSoftwareUpdateAgent", 
-        "process.pid": 21412, 
-        "system.syslog.timestamp": "Dec 13 11:35:28"
+        "process.pid": 21412
     }, 
     {
         "@timestamp": "2018-04-04T03:39:57.000Z", 
         "event.dataset": "syslog", 
         "event.module": "system", 
         "input.type": "log", 
         "log.offset": 1176, 
-        "message": "--- last message repeated 1 time ---", 
-        "system.syslog.timestamp": "Apr 4 03:39:57"
+        "message": "--- last message repeated 1 time ---"
     }
 ]