two quick questions regarding displaying osquery d...
# general
l
two quick questions regarding displaying osquery data. First, right now I have the data in ELK. Most of the fields are
column.something
. Is there a way to remove the
column.
from the records to have a cleaner display. I know I can do it at index time in elasticsearch but is there a native way to do it with osquery. Second, is there a way to remove the
pack_
from the pack names. I know you can change the delimiter but can you remove the entire
pack_
? All of my queries are in packs so having it there adds no value IMO and aesthetically it would look nicer.