diff --git a/logstash/config/01-wazuh.conf b/logstash/config/01-wazuh.conf index ee23fb08..524b9005 100644 --- a/logstash/config/01-wazuh.conf +++ b/logstash/config/01-wazuh.conf @@ -26,14 +26,14 @@ filter { geoip { source => "@src_ip" target => "GeoLocation" - fields => ["city_name", "continent_code", "country_code2", "country_name", "region_name", "location"] + fields => ["city_name", "country_name", "region_name", "location"] } date { match => ["timestamp", "ISO8601"] target => "@timestamp" } mutate { - remove_field => [ "timestamp", "beat", "input_type", "tags", "count", "@version", "log", "offset", "type","@src_ip"] + remove_field => ["timestamp", "beat", "input_type", "tags", "count", "@version", "log", "offset", "type", "@src_ip", "host"] } } output {