Change event.type to start

elastic · Jul 6, 2020 · c233fe3 · c233fe3
1 parent d11194e
commit c233fe3
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 3 deletions.
diff --git a/x-pack/filebeat/module/gsuite/saml/config/pipeline.js b/x-pack/filebeat/module/gsuite/saml/config/pipeline.js
@@ -6,7 +6,7 @@ var saml = (function () {
     var processor = require("processor");
 
     var categorizeEvent = function(evt) {
-        evt.Put("event.type", ["info"]);
+        evt.Put("event.type", ["start"]);
         evt.Put("event.category", ["authentication"]);
         switch (evt.Get("event.action")) {
             case "login_failure":

diff --git a/x-pack/filebeat/module/gsuite/saml/test/gsuite-saml-test.json.log-expected.json b/x-pack/filebeat/module/gsuite/saml/test/gsuite-saml-test.json.log-expected.json
@@ -26,7 +26,7 @@
         "event.outcome": "failure",
         "event.provider": "saml",
         "event.type": [
-            "info"
+            "start"
         ],
         "fileset.name": "saml",
         "gsuite.actor.type": "USER",
@@ -80,7 +80,7 @@
         "event.outcome": "success",
         "event.provider": "saml",
         "event.type": [
-            "info"
+            "start"
         ],
         "fileset.name": "saml",
         "gsuite.actor.type": "USER",