From e65b574cecea92f8bd1a4514c0208589980c35da Mon Sep 17 00:00:00 2001
From: Bharat Pasupula <123897612+bhapas@users.noreply.github.com>
Date: Mon, 23 Sep 2024 13:08:59 +0200
Subject: [PATCH] [Automatic Import] Do not remove message field for
 unstructured logs (#193678)

(cherry picked from commit 2106df354adaa48dae7d8457b7d3401104724fc9)
---
 .../integration_assistant/server/templates/pipeline.yml.njk   | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/x-pack/plugins/integration_assistant/server/templates/pipeline.yml.njk b/x-pack/plugins/integration_assistant/server/templates/pipeline.yml.njk
index ba846dc50fba9..d583d68c4b733 100644
--- a/x-pack/plugins/integration_assistant/server/templates/pipeline.yml.njk
+++ b/x-pack/plugins/integration_assistant/server/templates/pipeline.yml.njk
@@ -19,11 +19,11 @@ processors:
       field: originalMessage
       ignore_missing: true
       tag: remove_copied_message
-      if: 'ctx.event?.original != null'
+      if: 'ctx.event?.original != null'{% if log_format != 'unstructured' %}
   - remove:
       field: message
       ignore_missing: true
-      tag: remove_message{% if (log_format == 'json') or (log_format == 'ndjson') %}
+      tag: remove_message{% endif %}{% if (log_format == 'json') or (log_format == 'ndjson') %}
   - json:
       field: event.original
       tag: json_original