Solved - Ruby exceptions - updating filter to new api

Found the answer. Here is what I ended up with. If there is a better way, please do tell.
Thanks.

ruby {
code => "
if event.get('[event_type]') == 'fileinfo'
event.set('[fileinfo][type]', event.get('[fileinfo][magic]').to_s.split(',')[0])
end
"
}

1 Like