Fix Azure logstash parser in public release

philhagen / sof-elk

Configuration files for the SOF-ELK VM

GNU General Public License v3.0

1.46k stars 272 forks source link

Fix Azure logstash parser in public release #296

Open Pierre450 opened 8 months ago

Pierre450 commented 8 months ago

The Azure logstash parser in the public release is processing a lot less entries that the older version which are still using in the FOR509 class version. Something has changed, but it's not clear what it is.

philhagen commented 8 months ago

ok! @Pierre450 I am pretty sure I figured out what the problem was and my test against your capstone azure data is now consistent with the public and class versions. Please let me know if you see otherwise, but if it looks good, I will cherrypick this commit to the latest public branch