fix missing extra fields when the key doesn't contain a dot and flatt…

…enfields=true Signed-off-by: Thomas Labarussias <[email protected]>
falcosecurity · Oct 28, 2024 · 74ce82c · 74ce82c
1 parent 3b87d91
commit 74ce82c
Showing 1 changed file with 4 additions and 2 deletions.
diff --git a/outputs/elasticsearch.go b/outputs/elasticsearch.go
@@ -285,8 +285,10 @@ func (c *Client) buildESPayload(falcopayload types.FalcoPayload) eSPayload {
 
 	if c.Config.Elasticsearch.FlattenFields || c.Config.Elasticsearch.CreateIndexTemplate {
 		for i, j := range payload.OutputFields {
-			payload.OutputFields[strings.ReplaceAll(i, ".", "_")] = j
-			delete(payload.OutputFields, i)
+			if strings.Contains(i, ".") {
+				payload.OutputFields[strings.ReplaceAll(i, ".", "_")] = j
+				delete(payload.OutputFields, i)
+			}
 		}
 	}
 	return payload