Winlogbeat 5.1.1 and event_data.param as raw

Currently forwarding windows events to logstash 2.3.1and using elasticsearch 2.3.1 . I would like to get index as raw some of the event_data.param fields (as they could contain reserved characters such as "") .
How can I proceed ?

You need to update the template/mapping in ES to set that.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.