Less removal of data for the implants db
@@ -109,7 +109,8 @@ filter {
clone {
clones => [ "implantsdb" ]
#remove_field => [ "c2.timestamp","[beat][hostname]","[beat][name]","[beat][version]","beat","c2.log_type","c2.message","host","infralogtype","[prospector][type]" ]
- remove_field => [ "[c2][log][type]","[c2][message]","[infra][log_type]" ]
+ #remove_field => [ "[c2][log][type]","[c2][message]","[infra][log_type]" ]
+ remove_field => [ "[c2][message]","[infra][log_type]" ]
}
# Now set beacon link information if its a linked beacon.
if [implant][parent_id] {
