don't index cip_io.io_data above the first few bytes

cisagov · Apr 1, 2022 · f1c378f · f1c378f
1 parent 32c3f65
commit f1c378f
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/dashboards/malcolm_template.json b/dashboards/malcolm_template.json
@@ -265,7 +265,7 @@
         "zeek.cip_identity.vendor_name": { "type": "keyword" },
         "zeek.cip_io.connection_id": { "type": "keyword" },
         "zeek.cip_io.data_length": { "type": "integer" },
-        "zeek.cip_io.io_data": { "type": "keyword", "ignore_above": 128, "fields": { "text": { "type": "text", "norms": false } } },
+        "zeek.cip_io.io_data": { "type": "keyword", "ignore_above": 8, "fields": { "text": { "type": "text", "norms": false } } },
         "zeek.cip_io.sequence_number": { "type": "integer" },
         "zeek.conn.conn_state": { "type": "keyword" },
         "zeek.conn.conn_state_description": { "type": "keyword" },