counteractive / o365beat

Elastic Beat for fetching and shipping Office 365 audit events
Other
66 stars 27 forks source link

ModifiedProperties field is sent as object which causes problems for elasticsearch #14

Closed chris-counteractive closed 4 years ago

chris-counteractive commented 4 years ago

ModifiedProperties shows up as a field in some workloads and causes the same parsing problems as Parameters and ExtendedProperties. Because it's not a true set of key-value pairs, it will require more involved parsing, which should only be done when needed.

Fix will be the same as those other object fields: process them into a string which can then be deserialized or parsed if necessary, and avoids parsing error.