Update 12-suricata.conf

conf.d/12-suricata.conf

@@ -6,13 +6,13 @@ filter {
     }
     if [message] =~ /^{.*}$/ {
       json {
-        source => "message"
+        source => "syslog_message"
         target => "[suricata][eve]"
       }
     } else {
       grok {
         patterns_dir => ["/etc/logstash/conf.d/patterns"]
-        match => [ "message", "%{SURICATA}"]
+        match => [ "syslog_message", "%{SURICATA}"]
       }
     }
     if [suricata][eve][src_ip] and ![source][ip] {
@@ -92,7 +92,6 @@ filter {
         mutate {
 	    add_field => { "[event][module]" => "suricata"}
 	    add_field => { "[event][dataset]" => "suricata"}
-	    rename => { "[message]" => "[event][original]"}
     }
   }
 }