diff --git a/filter-group.conf b/filter-group.conf index 1021e84..6a57f9e 100644 --- a/filter-group.conf +++ b/filter-group.conf @@ -3,7 +3,7 @@ filter { grok { match => ["message","new group: name=%{DATA:[group][name]}, GID=%{NUMBER:[group][id]}"] id => "groupadd" - tag_on_failure => ["_grokparsefaillure","groupadd_grok_failed"] + tag_on_failure => ["_grokparsefailure","groupadd_grok_failed"] } } } \ No newline at end of file