tag audit logs

mcpherrinm · mcpherrinm · commit 003fbf6d9111 · 2026-01-11T21:13:52.000-05:00
diff --git a/test/otelcol/config.yaml b/test/otelcol/config.yaml
@@ -41,6 +41,10 @@ receivers:
         field: attributes.timestamp
       - type: remove
         field: attributes.syslogseverity
+      - type: add
+        field: attributes.audit
+        value: true
+        if: 'body startsWith "[AUDIT] "'
       - type: regex_parser
         regex: ' JSON=(?P<json_payload>\{.*\})$'
         if: 'body matches " JSON=\\{.*\\}$"'
