Add event.ingested to Netflow module (elastic#22412)

Add event.ingested to the pipeline in the Netflow Filebeat module. (cherry picked from commit fa9ebaa)
andrewkroh · Nov 5, 2020 · 1cdd119 · 1cdd119
1 parent c98e0bb
commit 1cdd119
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 0 deletions.
diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
@@ -740,6 +740,7 @@ field. You can revert this change by configuring tags for the module and omittin
 - Add SSL option to checkpoint module {pull}19560[19560]
 - Copy tag names from MISP data into events. {pull}21664[21664]
 - Added TLS JA3 fingerprint, certificate not_before/not_after, certificate SHA1 hash, and certificate subject fields to Zeek SSL dataset. {pull}21696[21696]
+- Added `event.ingested` field to data from the Netflow module. {pull}22412[22412]
 
 *Heartbeat*
 

diff --git a/x-pack/filebeat/module/netflow/log/ingest/pipeline.yml b/x-pack/filebeat/module/netflow/log/ingest/pipeline.yml
@@ -2,6 +2,10 @@
 description: Pipeline for Filebeat NetFlow
 
 processors:
+  - set:
+      field: event.ingested
+      value: '{{_ingest.timestamp}}'
+
   # IP Geolocation Lookup
   - geoip:
         if: ctx.source?.geo == null