updated santa module to use new nullcheck in set processors (elastic#…

…19417)
kvch · Jul 14, 2020 · 77d51c6 · 77d51c6
1 parent e16b6bd
commit 77d51c6
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/filebeat/module/santa/log/ingest/pipeline.yml b/filebeat/module/santa/log/ingest/pipeline.yml
@@ -20,6 +20,7 @@ processors:
     field: '@timestamp'
     value: '{{ process.start }}'
     ignore_failure: true
+    ignore_empty_value: true
 - split:
     field: santa.args
     separator: ' '
@@ -69,7 +70,7 @@ processors:
 - set:
     field: event.action
     value: "{{santa.action}}"
-    if: "ctx?.santa?.action != null"
+    ignore_empty_value: true
 - lowercase:
     field: event.action
     ignore_missing: true