From 383c242b491004606f644a0642e80687c055fa39 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Andris=20Strazdi=C5=86=C5=A1?= Date: Wed, 3 Dec 2025 17:38:04 +0200 Subject: [PATCH] Fix condition path mismatch Couple of rename processor conditions look at wrong path before rename. --- .../elasticsearch/ingest_pipeline/default.yml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/packages/kubernetes/data_stream/audit_logs/elasticsearch/ingest_pipeline/default.yml b/packages/kubernetes/data_stream/audit_logs/elasticsearch/ingest_pipeline/default.yml index 78af39617a5..2e6f4191672 100644 --- a/packages/kubernetes/data_stream/audit_logs/elasticsearch/ingest_pipeline/default.yml +++ b/packages/kubernetes/data_stream/audit_logs/elasticsearch/ingest_pipeline/default.yml @@ -101,31 +101,31 @@ processors: field: kubernetes.audit.insertId target_field: kubernetes.audit.auditID ignore_missing: true - if: ctx.audit?.auditID == null + if: ctx.kubernetes?.audit?.auditID == null tag: rename_audit_id - rename: field: kubernetes.audit.receiveTimestamp target_field: kubernetes.audit.requestReceivedTimestamp ignore_missing: true - if: ctx.audit?.requestReceivedTimestamp == null + if: ctx.kubernetes?.audit?.requestReceivedTimestamp == null tag: rename_requestReceivedTimestamp - rename: field: kubernetes.audit.timestamp target_field: kubernetes.audit.stageTimestamp ignore_missing: true - if: ctx.audit?.stageTimestamp == null + if: ctx.kubernetes?.audit?.stageTimestamp == null tag: rename_stageTimestamp - rename: field: kubernetes.audit.protoPayload.status.code target_field: kubernetes.audit.responseStatus.code ignore_missing: true - if: ctx.audit?.responseStatus?.code == null + if: ctx.kubernetes?.audit?.responseStatus?.code == null tag: rename_responseStatusCode - rename: field: kubernetes.audit.labels target_field: kubernetes.audit.annotations ignore_missing: true - if: ctx.audit?.annotations == null + if: ctx.kubernetes?.audit?.annotations == null tag: rename_labels - script: lang: painless