From 09128b5e8d0045f7f61334941243a178295f67ab Mon Sep 17 00:00:00 2001
From: Andrew Kroh <andrew.kroh@elastic.co>
Date: Mon, 11 Jan 2021 10:15:00 -0500
Subject: [PATCH] Sync changes to AWS CloudTrail

https://github.com/elastic/integrations/pull/408
---
 x-pack/filebeat/module/aws/cloudtrail/ingest/pipeline.yml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/x-pack/filebeat/module/aws/cloudtrail/ingest/pipeline.yml b/x-pack/filebeat/module/aws/cloudtrail/ingest/pipeline.yml
index 3dd78f82c6d..76cf0f936b6 100644
--- a/x-pack/filebeat/module/aws/cloudtrail/ingest/pipeline.yml
+++ b/x-pack/filebeat/module/aws/cloudtrail/ingest/pipeline.yml
@@ -152,25 +152,25 @@ processors:
             Map map = new HashMap();
             ctx.aws.cloudtrail.put("flattened", map);
           }
-        if (ctx.json.requestParameters != null) {
+        if (ctx.json?.requestParameters != null) {
           ctx.aws.cloudtrail.request_parameters = ctx.json.requestParameters.toString();
           if (ctx.aws.cloudtrail.request_parameters.length() < 32766) {
             ctx.aws.cloudtrail.flattened.put("request_parameters", ctx.json.requestParameters);
           }
         }
-        if (ctx.json.responseElements != null) {
+        if (ctx.json?.responseElements != null) {
           ctx.aws.cloudtrail.response_elements = ctx.json.responseElements.toString();
           if (ctx.aws.cloudtrail.response_elements.length() < 32766) {
             ctx.aws.cloudtrail.flattened.put("response_elements", ctx.json.responseElements);
           }
         }
-        if (ctx.json.additionalEventData != null) {
+        if (ctx.json?.additionalEventData != null) {
           ctx.aws.cloudtrail.additional_eventdata = ctx.json.additionalEventData.toString();
           if (ctx.aws.cloudtrail.additional_eventdata.length() < 32766) {
             ctx.aws.cloudtrail.flattened.put("additional_eventdata", ctx.json.additionalEventData);
           }
         }
-        if (ctx.json.serviceEventDetails != null) {
+        if (ctx.json?.serviceEventDetails != null) {
           ctx.aws.cloudtrail.service_event_details = ctx.json.serviceEventDetails.toString();
           if (ctx.aws.cloudtrail.service_event_details.length() < 32766) {
             ctx.aws.cloudtrail.flattened.put("service_event_details", ctx.json.serviceEventDetails);