diff --git a/google_secops_parser/parsedmarc.conf b/google_secops_parser/parsedmarc.conf index ca5c13b..74624f7 100644 --- a/google_secops_parser/parsedmarc.conf +++ b/google_secops_parser/parsedmarc.conf @@ -177,7 +177,7 @@ filter { on_error => "no_json_payload" } if [no_json_payload] { - drop {} + drop { tag => "TAG_MALFORMED_ENCODING" } } json { @@ -185,7 +185,7 @@ filter { on_error => "not_json" } if [not_json] { - drop {} + drop { tag => "TAG_MALFORMED_ENCODING" } } # --------------------------------------------------------------------------- @@ -232,7 +232,7 @@ filter { # Not a parsedmarc record we recognize: drop rather than emit an invalid event. if [report_type] == "" { - drop {} + drop { tag => "TAG_UNSUPPORTED" } } # ===========================================================================