Add files via upload

2.9.1 compatibility hacks.

Author: Alex-Kw

2081_filter_section_h_convert_to_key-value.conf

@@ -10,6 +10,13 @@ filter {
     #~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
     if [rawSectionH] =~ /.+/ {
+      # For 2.9.1+ compatibility
+      mutate {
+        # This works for most things, but if the error has things like REQUEST_HEADERS:Referer in it, it can be problematic.
+      # gsub => [ "rawSectionH", 'ModSecurity:', 'ModSecurity' ]
+        # Alternately, just drop "Apache-Error:" from rawSectionH.
+        gsub => [ "rawSectionH", '^Apache-Error:.*', '' ]
+      }
       kv {
         source => "rawSectionH"
         field_split => "\n"