Remove pre populated event.timezone

elastic · Jul 29, 2020 · 8f1dc4c · 8f1dc4c
1 parent fb52d26
commit 8f1dc4c
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 2 deletions.
diff --git a/x-pack/filebeat/module/fortinet/firewall/ingest/pipeline.yml b/x-pack/filebeat/module/fortinet/firewall/ingest/pipeline.yml
@@ -27,6 +27,9 @@ processors:
 - set:
     field: event.dataset
     value: fortinet.firewall
+- remove:
+    field: event.timezone
+    ignore_missing: true
 - set:
     field: event.timezone
     value: "{{fortinet.firewall.tz}}"
@@ -178,4 +181,4 @@ processors:
 on_failure:
 - set:
     field: error.message
-    value: '{{ _ingest.on_failure_message }}'
+    value: '{{ _ingest.on_failure_message }}'
diff --git a/x-pack/filebeat/module/fortinet/firewall/test/fortinet.log-expected.json b/x-pack/filebeat/module/fortinet/firewall/test/fortinet.log-expected.json
@@ -96,7 +96,6 @@
         "event.module": "fortinet",
         "event.outcome": "success",
         "event.start": "2020-06-24T01:16:08.000Z",
-        "event.timezone": "-02:00",
         "event.type": [
             "connection",
             "end"