Find and Replace - Winlogbeat

After upgrading my sidecars and finding out that fieldnames have changed <insert winlog_ here> I was lamenting that browsers don’t have a find/replace feature for editing. It was my pleasant surprise that ctrl-F while in the body of the pipeline rule will bring up a find/replace for you:

image

This also allowed me to check off the box on the beats Input to “…not add the beats type as prefix” since I was already cleaning up all beats rules.
image

2 Likes