Updated Posh filter

Removed param3 field from EID 400 and 600
2017-12-19 01:28:31 -05:00 · 2017-12-19 01:28:31 -05:00 · e5f4d646fd
parent e2be226b94
commit e5f4d646fd
1 changed files with 1 additions and 0 deletions
--- a/logstash/pipeline/10-powershell-filter.conf
+++ b/logstash/pipeline/10-powershell-filter.conf
@ -121,6 +121,7 @@ filter {
        remove_field => [ "message" ]
        remove_field => "[event_data][param1]"
        remove_field => "[event_data][param2]"
+        remove_field => "[event_data][param3]"
      }
    }
  }