Update logstash filter

Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>
Security-Onion-Solutions · Nov 3, 2023 · 00b3882 · 00b3882
1 parent bc11e06
commit 00b3882
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/logstash.rst b/logstash.rst
@@ -58,7 +58,7 @@ For example, to forward all :ref:`zeek` events from the ``dns`` dataset, we coul
 ::
 
             output {
-              if [module] =~ "zeek" and [dataset] =~ "dns" {
+              if [event][module] == "zeek" and [pipeline] == "dns" {
                 udp {
                   id => "cloned_events_out"
                   host => "192.168.x.x"