From 77d51c6890067e34823b883ac63f1e8726937571 Mon Sep 17 00:00:00 2001
From: Marius Iversen <pillus@chasenet.org>
Date: Tue, 14 Jul 2020 14:02:19 +0200
Subject: [PATCH] updated santa module to use new nullcheck in set processors
 (#19417)

---
 filebeat/module/santa/log/ingest/pipeline.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/filebeat/module/santa/log/ingest/pipeline.yml b/filebeat/module/santa/log/ingest/pipeline.yml
index 11ad4cead6ca..9b68cce3644e 100644
--- a/filebeat/module/santa/log/ingest/pipeline.yml
+++ b/filebeat/module/santa/log/ingest/pipeline.yml
@@ -20,6 +20,7 @@ processors:
     field: '@timestamp'
     value: '{{ process.start }}'
     ignore_failure: true
+    ignore_empty_value: true
 - split:
     field: santa.args
     separator: ' '
@@ -69,7 +70,7 @@ processors:
 - set:
     field: event.action
     value: "{{santa.action}}"
-    if: "ctx?.santa?.action != null"
+    ignore_empty_value: true
 - lowercase:
     field: event.action
     ignore_missing: true