Open andrewkroh opened 1 year ago
Pinging @elastic/security-external-integrations (Team:Security-External Integrations)
Another option, could the @metadata.pipeline field be populated by Winlogbeat like it is for all the Filebeat modules so the original logic works?
Pinging @elastic/sec-windows-platform (Team:Security-Windows Platform)
The documentation for Winlogbeat modules should show an example of how to configure Logstash to route data to the "routing" pipeline. I have seen a number of questions relating to this.
https://www.elastic.co/guide/en/beats/winlogbeat/current/winlogbeat-modules.html
https://discuss.elastic.co/t/winlogbeat-logs-sent-through-logstash-arent-parsed-correctly/338076