[Automatic Import] Do not remove message field for unstructured logs (#…

…193678) (cherry picked from commit 2106df3)
elastic · Sep 23, 2024 · e65b574 · e65b574
1 parent 156a76c
commit e65b574
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/x-pack/plugins/integration_assistant/server/templates/pipeline.yml.njk b/x-pack/plugins/integration_assistant/server/templates/pipeline.yml.njk
@@ -19,11 +19,11 @@ processors:
       field: originalMessage
       ignore_missing: true
       tag: remove_copied_message
-      if: 'ctx.event?.original != null'
+      if: 'ctx.event?.original != null'{% if log_format != 'unstructured' %}
   - remove:
       field: message
       ignore_missing: true
-      tag: remove_message{% if (log_format == 'json') or (log_format == 'ndjson') %}
+      tag: remove_message{% endif %}{% if (log_format == 'json') or (log_format == 'ndjson') %}
   - json:
       field: event.original
       tag: json_original