I have winbeats installed and things are working great. I have a field that is called:
and an actual value is:
technique_id=T1130,technique_name=Install Root Certificate
I would like to split that field into two fields.
technique_id and the other technique_name. Each field would have its perspective values.
Would I use something like split field?
If so, how do I apply this to any index starting with winlogbeat-*