[7.0] Update beats framework to aa6953a

NOTICE.txt

@@ -245,7 +245,7 @@ SOFTWARE.
 --------------------------------------------------------------------
 Dependency: github.com/elastic/beats
 Version: 7.0
-Revision: 4920cd69346f6320f9bdebcff602ba874666f492
+Revision: aa6953a32b7ca4cf3fc14363fbedb1d1ff8dd24d
 License type (autodetected): Apache-2.0
 ./vendor/github.com/elastic/beats/LICENSE.txt:
 --------------------------------------------------------------------
@@ -311,7 +311,7 @@ Apache License 2.0
 
 --------------------------------------------------------------------
 Dependency: github.com/elastic/go-sysinfo
-Revision: 59ef8c0eae46c0929e3b219ac86368d4b5934f91
+Revision: ab4f04edfc3d6b3864f5f06a068ddab9ad79774f
 License type (autodetected): Apache-2.0
 ./vendor/github.com/elastic/go-sysinfo/LICENSE.txt:
 --------------------------------------------------------------------

_beats/dev-tools/ecs-migration.yml

@@ -463,7 +463,26 @@
 - from: system.auth.hostname
  to: host.hostname
  alias: true
- copy_to: false
+ beat: filebeat
+
+- from: system.auth.message
+ to: message
+ alias: true
+ beat: filebeat
+
+- from: system.auth.program
+ to: process.name
+ alias: true
+ beat: filebeat
+
+- from: system.auth.timestamp
+ to: '@timestamp'
+ alias: true
+ beat: filebeat
+
+- from: system.auth.user
+ to: user.name
+ alias: true
  beat: filebeat
 
 - from: system.auth.pid
@@ -476,18 +495,23 @@
  alias: true
  beat: filebeat
 
-- from: system.auth.useradd.uid
- to: user.id
+- from: system.auth.groupadd.name
+ to: group.name
  alias: true
  beat: filebeat
 
-- from: system.auth.useradd.user
- to: user.name
+- from: system.auth.useradd.gid
+ to: group.id
  alias: true
  beat: filebeat
 
-- from: system.auth.ssh.event
- to: event.action
+- from: system.auth.useradd.uid
+ to: user.id
+ alias: true
+ beat: filebeat
+
+- from: system.auth.useradd.name
+ to: user.name
  alias: true
  beat: filebeat
 
@@ -687,11 +711,6 @@
 
 ## Elasticsearch module
 
-- from: elasticsearch.audit.event_type
- to: event.type
- alias: true
- beat: filebeat
-
 - from: elasticsearch.audit.origin_address
  to: source.ip
  alias: true
@@ -1156,6 +1175,11 @@
 
 ## NGINX module
 
+- from: nginx.access.remote_ip
+ to: source.address
+ alias: true
+ beat: filebeat
+
 - from: nginx.access.user_name
  to: user.name
  alias: true

_beats/libbeat/docs/version.asciidoc

@@ -1,4 +1,4 @@
-:stack-version: 7.0.0-beta1
+:stack-version: 7.0.0-rc2
 :doc-branch: 7.0
 :go-version: 1.11.5
 :release-state: prerelease

_beats/libbeat/scripts/Makefile

@@ -250,7 +250,7 @@ load-tests: ## @testing Runs load tests
 # Sets up the virtual python environment
 .PHONY: python-env
 python-env: ${ES_BEATS}/libbeat/tests/system/requirements.txt
- @test -d ${PYTHON_ENV} || virtualenv ${VIRTUALENV_PARAMS} ${PYTHON_ENV}
+ @test -d ${PYTHON_ENV} || virtualenv $(if ${PYTHON_EXE},-p ${PYTHON_EXE}) ${VIRTUALENV_PARAMS} ${PYTHON_ENV}
  @. ${PYTHON_ENV}/bin/activate && pip install ${PIP_INSTALL_PARAMS} -q --upgrade pip ; \
  if [ -a ./tests/system/requirements.txt ] && [ ! ${ES_BEATS}/libbeat/tests/system/requirements.txt -ef ./tests/system/requirements.txt ] ; then \
  . ${PYTHON_ENV}/bin/activate && pip install ${PIP_INSTALL_PARAMS} -qUr ${ES_BEATS}/libbeat/tests/system/requirements.txt -Ur ./tests/system/requirements.txt ; \

_beats/libbeat/tests/system/beat/beat.py

@@ -220,6 +220,9 @@ def start_beat(self,
 
  def render_config_template(self, template_name=None,
  output=None, **kargs):
+
+ print("render config")
+
  # Init defaults
  if template_name is None:
  template_name = self.beat_name

_beats/testing/environments/docker/kafka/Dockerfile

@@ -4,7 +4,7 @@ ENV KAFKA_HOME /kafka
 # The advertised host is kafka. This means it will not work if container is started locally and connected from localhost to it
 ENV KAFKA_ADVERTISED_HOST kafka
 ENV KAFKA_LOGS_DIR="/kafka-logs"
-ENV KAFKA_VERSION 2.1.0
+ENV KAFKA_VERSION 2.1.1
 ENV _JAVA_OPTIONS "-Djava.net.preferIPv4Stack=true"
 ENV TERM=linux
 

_beats/vendor/vendor.json

@@ -951,44 +951,44 @@
  {
  "checksumSHA1": "QhFIpuHPaV6hKejKcc2wm6y4MSQ=",
  "path": "github.com/elastic/go-sysinfo",
- "revision": "59ef8c0eae46c0929e3b219ac86368d4b5934f91",
- "revisionTime": "2019-01-07T12:18:35Z"
+ "revision": "ab4f04edfc3d6b3864f5f06a068ddab9ad79774f",
+ "revisionTime": "2019-03-27T18:53:17Z"
  },
  {
  "checksumSHA1": "GiZCjX17K265TtamGZZw4R2Jwbk=",
  "path": "github.com/elastic/go-sysinfo/internal/registry",
- "revision": "59ef8c0eae46c0929e3b219ac86368d4b5934f91",
- "revisionTime": "2019-01-07T12:18:35Z"
+ "revision": "ab4f04edfc3d6b3864f5f06a068ddab9ad79774f",
+ "revisionTime": "2019-03-27T18:53:17Z"
  },
  {
  "checksumSHA1": "ovafihHzpBx9Y7+lZh9X5KwNCvE=",
  "path": "github.com/elastic/go-sysinfo/providers/darwin",
- "revision": "59ef8c0eae46c0929e3b219ac86368d4b5934f91",
- "revisionTime": "2019-01-07T12:18:35Z"
+ "revision": "ab4f04edfc3d6b3864f5f06a068ddab9ad79774f",
+ "revisionTime": "2019-03-27T18:53:17Z"
  },
  {
- "checksumSHA1": "AK76ZxnuvK02Dfpmj7b2TD/aiSI=",
+ "checksumSHA1": "OyI+VwDiT4UZjncsDr1GYg1xcdw=",
  "path": "github.com/elastic/go-sysinfo/providers/linux",
- "revision": "59ef8c0eae46c0929e3b219ac86368d4b5934f91",
- "revisionTime": "2019-01-07T12:18:35Z"
+ "revision": "ab4f04edfc3d6b3864f5f06a068ddab9ad79774f",
+ "revisionTime": "2019-03-27T18:53:17Z"
  },
  {
  "checksumSHA1": "RWLvcP1w9ynKbuCqiW6prwd+EDU=",
  "path": "github.com/elastic/go-sysinfo/providers/shared",
- "revision": "59ef8c0eae46c0929e3b219ac86368d4b5934f91",
- "revisionTime": "2019-01-07T12:18:35Z"
+ "revision": "ab4f04edfc3d6b3864f5f06a068ddab9ad79774f",
+ "revisionTime": "2019-03-27T18:53:17Z"
  },
  {
  "checksumSHA1": "aF05MEkMjbRekzHlwFxmd5WBpeY=",
  "path": "github.com/elastic/go-sysinfo/providers/windows",
- "revision": "59ef8c0eae46c0929e3b219ac86368d4b5934f91",
- "revisionTime": "2019-01-07T12:18:35Z"
+ "revision": "ab4f04edfc3d6b3864f5f06a068ddab9ad79774f",
+ "revisionTime": "2019-03-27T18:53:17Z"
  },
  {
  "checksumSHA1": "MLQioPEjULYbNqqCjfB1/cux08E=",
  "path": "github.com/elastic/go-sysinfo/types",
- "revision": "59ef8c0eae46c0929e3b219ac86368d4b5934f91",
- "revisionTime": "2019-01-07T12:18:35Z"
+ "revision": "ab4f04edfc3d6b3864f5f06a068ddab9ad79774f",
+ "revisionTime": "2019-03-27T18:53:17Z"
  },
  {
  "checksumSHA1": "bNf3GDGhZh86bfCIMM5c5AYfo3g=",