From 8e5d8abc68a2f3d510419c9d58cf6a76bffb8025 Mon Sep 17 00:00:00 2001 From: Guilherme Ferreira Date: Wed, 6 Feb 2019 14:17:36 +0100 Subject: [PATCH] correct key is "clientip", not only "ip" If I understood well, whatever name you point to be used, it will be "key' name exported ... --- docs/reference/ingest/ingest-node.asciidoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/reference/ingest/ingest-node.asciidoc b/docs/reference/ingest/ingest-node.asciidoc index 2d0e222741929..c4bb9b6eba47c 100644 --- a/docs/reference/ingest/ingest-node.asciidoc +++ b/docs/reference/ingest/ingest-node.asciidoc @@ -1810,7 +1810,7 @@ Named skip key modifier example | *Pattern* | `%{clientip} %{?ident} %{?auth} [%{@timestamp}]` | *Input* | 1.2.3.4 - - [30/Apr/1998:22:00:52 +0000] | *Result* a| -* ip = 1.2.3.4 +* clientip = 1.2.3.4 * @timestamp = 30/Apr/1998:22:00:52 +0000 |======