Graylog Collector--Preserving YAML key order

[bluescreenofwin]

Is there a way to preserve the key order of the items in ‘Event name’? For example, If I put in the following in the Event Name field:

[{‘processors’:,‘drop_event.when.and’:,‘equals.log_name’:‘Security’,‘not.or’:,‘equals.event_id’:‘4771’,‘equals.event_id’:‘4688’}]

It outputs like this:

• drop_event.when.and: null
  equals.event_id: “4688”
  equals.log_name: Security
  not.or: null
  processors: null

Any ideas? I am loving Graylog but the collector has been the most fickle thing I’ve ever used.

Edit: Is this something I need to use a Snippet to accomplish?

[jan (Jan Doberstein)]

the Version 3.0 will have multiple improvements for the sidecar that will make your request possible.

Currently, I’m not sure if this is a filebeat issue (I assume you use filebeat as a collector with the sidecar) or not.