After changes, I restarted several times and even wait one day to see the effect.
but nothing changed.
This is what I want to change(original under event >> event.original) line 1761:
- name: original
description: 'Raw text message of the entire event. Used to demonstrate log integrity
or where the full log message (before splitting it up into multiple parts) may
be required, e.g. for reindex.
I need to change the type: keyword to wildcard
How can I do this?