Content differences:
--- /etc/nginx/sites-available/xmldumps.orig
+++ /etc/nginx/sites-available/xmldumps
@@ -33,7 +33,9 @@
# This directive configures the ECS compatible JSON log format.
# The '$schema', 'meta' and 'dt' fields are required by the Event Platform so that
# these events can be ingested into the Data Lake (see T291645). 'dt' is the Event
-# Platform time field; '@timestamp' is retained for ECS compatibility.
+# Platform time field. Event Platform schemas cannot contain an '@' in field names,
+# so '@timestamp' is intentionally not emitted; logstash sets its own @timestamp
+# when indexing into OpenSearch.
log_format ecs_json escape=json
'{'
'"${dollar}schema":"/development/elastic/ecs/1.0.0",'
@@ -44,13 +46,12 @@
'"domain":"$host"'
'},'
'"dt":"$time_iso8601",'
- '"@timestamp":"$time_iso8601",'
'"ecs":{"version":"1.11.0"},'
'"event":{'
'"dataset":"dumps.access",'
'"kind":"event",'
- '"category":"web",'
- '"type":"access",'
+ '"category":["web"],'
+ '"type":["access"],'
'"outcome":"$ecs_event_outcome"'
'},'
'"http":{'