I'm working with Winlogbeat and I need event_data.CommandLine field to 'text' so I can run 'term' query on it and look for badness, I guess multi-fields is the way to go to add another field as text... Trying to get my head around this without screwing up what I already have - Current - { "winl…

Multi-field on CommandLine in Winlogbeat

mathurin68 (Mathurin68) January 16, 2018, 10:10pm 7

That would definitely make things easier on me, and that's good to know about the fields.yml!

Thank you so much -

I cleaned it up and sort of re-asked it here, if I could close it I would...

I am definitely going to redo this using the fields.yml.