Azure Interactive signin split was incorrect

Cargill · Oct 24, 2024 · 5de8f08 · 5de8f08
1 parent 4cb0acf
commit 5de8f08
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/config/processors/event_hub_audit_azure.event_hub_interactive_signin.conf b/config/processors/event_hub_audit_azure.event_hub_interactive_signin.conf
@@ -19,7 +19,7 @@ filter {
       skip_on_invalid_json => false
       tag_on_failure => "_jsonparsefailure_split_msg"
     }
-  if [message] =~ '^{"records": \[' {
+  if [message] =~ '^{(\s+)?"records".*?$' {
     split {
       field => "[tmp][records]"
       target => "az"