The configtracker index contains a json path of: data.changes{}.properties{} In that path, there are numerous objects ... data changes properties
+ ( contains name, old_value, new_value )
+ ( contains name, old_value, new_value ) + ( contains name, old_value, new_value ) I've tried numerous ways of parsing data.changes{}.properties{} ... but am still finding myself unable to display the name, old_value, and new_value of each object beneath data->changes->properties ... Ultimately, I'd like to be able to render a table of "name" where an old_value exists so that we can alert on changed correlation searches in ES. ie: where "name" = search (and both old_value and new_value are not empty) { [-] name: search new_value: `sysmon` foo old_value: `sysmon` bar } or: where "name" = cron_schedule (and both old_value and new_value are not empty) { [-] name: cron_schedule new_value: 6-56/10 * * * * old_value: */10 * * * * } or: where a search schedule was enabled { [-] name: enableSched new_value: 1 old_value: 0 }
... View more