Thanks for the response. I'm using Elasticsearch 7.0.0 and unfortunatly the document isn't marked as "supicious". This is my response if I run the pipeline:
{
"docs" : [
{
"doc" : {
"_index" : "_index",
"_type" : "_doc",
"_id" : "_id",
"_source" : {
"event_data" : {
"SHA256" : "A993F8C574E0FEA8C1CDCBCD9408D9E2E107EE6E4D120EDCFA11DECD53FA0CAE",
"SHA1" : "9FA11A63B43F83980E0B48DC9BA2CB59D545A4E8",
"MD5" : "D7B20F933BE6CDAE41EFBE75548EBA5F",
"IMPHASH" : "D989D7ADF6957F1A88BB1332E40317E6"
}
},
"_ingest" : {
"timestamp" : "2019-05-06T08:09:44.740576Z"
}
}
}
]
}