From 582242ae068c4e51ae763da7c644b9bf72cfd21e Mon Sep 17 00:00:00 2001 From: Marius Iversen Date: Mon, 22 Feb 2021 10:27:25 +0100 Subject: [PATCH] indicator type url is in upper case --- x-pack/filebeat/module/threatintel/otx/ingest/pipeline.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/x-pack/filebeat/module/threatintel/otx/ingest/pipeline.yml b/x-pack/filebeat/module/threatintel/otx/ingest/pipeline.yml index ffd95787726..a4a16035111 100644 --- a/x-pack/filebeat/module/threatintel/otx/ingest/pipeline.yml +++ b/x-pack/filebeat/module/threatintel/otx/ingest/pipeline.yml @@ -89,7 +89,7 @@ processors: field: threatintel.otx.indicator target_field: threatintel.indicator.url.full ignore_missing: true - if: "ctx?.threatintel?.otx?.type == 'url' && ctx?.threatintel?.indicator?.url?.original == null" + if: "ctx?.threatintel?.otx?.type == 'URL' && ctx?.threatintel?.indicator?.url?.original == null" - rename: field: threatintel.otx.indicator target_field: threatintel.indicator.url.path