diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index 56f01376bd6..ff6f214e9fb 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -740,6 +740,7 @@ field. You can revert this change by configuring tags for the module and omittin - Add SSL option to checkpoint module {pull}19560[19560] - Copy tag names from MISP data into events. {pull}21664[21664] - Added TLS JA3 fingerprint, certificate not_before/not_after, certificate SHA1 hash, and certificate subject fields to Zeek SSL dataset. {pull}21696[21696] +- Added `event.ingested` field to data from the Netflow module. {pull}22412[22412] *Heartbeat* diff --git a/x-pack/filebeat/module/netflow/log/ingest/pipeline.yml b/x-pack/filebeat/module/netflow/log/ingest/pipeline.yml index 934e33ad564..a793268db3d 100644 --- a/x-pack/filebeat/module/netflow/log/ingest/pipeline.yml +++ b/x-pack/filebeat/module/netflow/log/ingest/pipeline.yml @@ -2,6 +2,10 @@ description: Pipeline for Filebeat NetFlow processors: + - set: + field: event.ingested + value: '{{_ingest.timestamp}}' + # IP Geolocation Lookup - geoip: if: ctx.source?.geo == null