I am writing parser extension and want to update
security_result.description field.if [@computed][message] != "" {mutate
{replace => {"security_result.description" =>
"%{@computed.message}"}}mutate {merge =>
{"event.idm.read_only_udm.security_result"...