elasticsearch/logstash — pull request #1690 by tomrade (2014-09-03 13:45:07+00:00)
Title: Coverage Issues

I found during a deployment that I the "src_ip" and "dst_ip" fields can be a hostname , I replaced "IP" with "IPORHOST". The field name was changed to "src_host" and "dst_host" to reflect this. I just did a find and replace , so this may need more careful replacement.

I also found that the "WORD" pattern used for policy_id will not hit on strings with special characters as some policy_id's were observed with these in. I have changed the pattern for "CISCOFW106100" to reflect this by replacing "WORD" with "NOTSPACE" on the field "policy_id".