Move logic to ingest pipeline nad upgrade ECS to 1.8.0 (#23875)

elastic · Feb 8, 2021 · 005266e · 005266e
1 parent c51272d
commit 005266e
Show file tree

Hide file tree

Showing 15 changed files with 971 additions and 530 deletions.
diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
@@ -841,6 +841,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 - Added RFC6587 framing option for tcp and unix inputs {issue}23663[23663] {pull}23724[23724]
 - Upgrade Cisco ASA/FTD/Umbrella to ECS 1.8.0. {pull}23819[23819]
 - Add new ECS user and categories features to google_workspace/gsuite {issue}23118[23118] {pull}23709[23709]
+- Move crowdstrike JS processor to ingest pipelines and upgrade to ECS 1.8.0 {issue}23118[23118] {pull}23875[23875]
 
 *Heartbeat*
 

diff --git a/x-pack/filebeat/module/crowdstrike/falcon/config/falcon.yml b/x-pack/filebeat/module/crowdstrike/falcon/config/falcon.yml
@@ -16,11 +16,18 @@ tags: {{.tags | tojson}}
 publisher_pipeline.disable_host: {{ inList .tags "forwarded" }}
 
 processors:
-- script:
-    lang: javascript
-    id: crowdstrike_falcon
-    file: ${path.home}/module/crowdstrike/falcon/config/pipeline.js
+- decode_json_fields:
+    fields:
+      - message
+    target: crowdstrike
+    process_array: true
+    max_depth: 8
+- drop_fields:
+    fields:
+      - message
+      - host.name
+    ignore_missing: true
 - add_fields:
     target: ''
     fields:
-      ecs.version: 1.7.0
+      ecs.version: 1.8.0