auditLogTrailerMessages is removed in previous section.

bitsofinfo · Jun 18, 2017 · cb985d8 · cb985d8
1 parent cb91dbd
commit cb985d8
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/2089_filter_section_h_example_severities.conf b/2089_filter_section_h_example_severities.conf
@@ -11,7 +11,7 @@ filter {
     ruby {
       code => "
           modsecSeverities = Set.new
-          trailerMsgs = event.get('auditLogTrailerMessages').to_hash
+          trailerMsgs = event.get('auditLogTrailer[messages]')
           trailerMsgs.each {|m|
             if m.key?('severity')
               modsecSeverities.add(m['severity'])