convert event.severity to long via grok

elastic · Nov 4, 2024 · b0f92da · b0f92da
1 parent 8b89ab0
commit b0f92da
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/packages/cisco_aironet/data_stream/log/elasticsearch/ingest_pipeline/default.yml b/packages/cisco_aironet/data_stream/log/elasticsearch/ingest_pipeline/default.yml
@@ -36,8 +36,8 @@ processors:
       field: _temp_.full_message
       ignore_failure: true
       patterns:
-        - "%{DATA:event.provider}-%{INT:event.severity}-%{DATA:event.action}: %{DATA}:%{INT} %{GREEDYDATA:message}"
-        - "%{DATA:event.provider}-%{INT:event.severity}-%{DATA:event.action}: %{GREEDYDATA:message}"
+        - "%{DATA:event.provider}-%{INT:event.severity:long}-%{DATA:event.action}: %{DATA}:%{INT} %{GREEDYDATA:message}"
+        - "%{DATA:event.provider}-%{INT:event.severity:long}-%{DATA:event.action}: %{GREEDYDATA:message}"
   - grok:
       field: _temp_.full_message
       ignore_failure: true