Use t_legacy_hdr_msg for rogue lss messages

* Update sc4s template to `t_legacy_hdr_msg` for rogue lss messages
CSVD · Apr 21, 2020 · ed10930 · ed10930
1 parent 7414386
commit ed10930
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/package/etc/conf.d/log_paths/lp-zscaler_lss.conf.tmpl b/package/etc/conf.d/log_paths/lp-zscaler_lss.conf.tmpl
@@ -86,7 +86,7 @@ log {
         };
         parser { p_add_context_splunk(key("zscaler_lss")); };
         parser (compliance_meta_by_source);
-        rewrite { set("$(template ${.splunk.sc4s_template} $(template t_msg_only))" value("MSG")); };
+        rewrite { set("$(template ${.splunk.sc4s_template} $(template t_legacy_hdr_msg))" value("MSG")); };
     };