From 3c2b05258710e7199053a31a7a43ae0ad89ec0eb Mon Sep 17 00:00:00 2001 From: Andrew Kroh Date: Fri, 26 Jun 2020 11:10:44 -0400 Subject: [PATCH] Fix tags for coredns/envoyproxy (#19134) (#19299) When {{ .tags }} is evaluated in the module config it not written in the correct format. This fixes that issue and also conditionally enables `publisher_pipeline.disable_host` based on whether tags contains `forwarded` to be consistent with every other module that allows for `var.tags` to be set (relates: #13920). For example (https://play.golang.org/p/LUr-X94msd1): var.tags: [foo, bar] will be written into the config as tags: [foo bar] which is a single value array containing the string "foo bar" rather than two tags. (cherry picked from commit b48c38802136b128e1126ade150557c758f5ce40) --- CHANGELOG.next.asciidoc | 4 +++- x-pack/filebeat/module/coredns/log/config/coredns.yml | 3 ++- x-pack/filebeat/module/envoyproxy/log/config/envoyproxy.yml | 3 ++- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index c27a9bb599d..fa2a1e9b2ef 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -50,8 +50,10 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d * iptables {pull}18756[18756] * Checkpoint {pull}18754[18754] * Netflow {pull}19087[19087] -* Suricata {pull}19107[19107] (`forwarded` tag is not included by default) * Zeek {pull}19113[19113] (`forwarded` tag is not included by default) +* Suricata {pull}19107[19107] (`forwarded` tag is not included by default) +* CoreDNS {pull}19134[19134] (`forwarded` tag is not included by default) +* Envoy Proxy {pull}19134[19134] (`forwarded` tag is not included by default) - Preserve case of http.request.method. ECS prior to 1.6 specified normalizing to lowercase, which lost information. Affects filesets: apache/access, elasticsearch/audit, iis/access, iis/error, nginx/access, nginx/ingress_controller, aws/elb, suricata/eve, zeek/http. {issue}18154[18154] {pull}18359[18359] - With the default configuration the cloud modules (aws, azure, googlecloud, o365, okta) will no longer send the `host` field that contains information about the host Filebeat is diff --git a/x-pack/filebeat/module/coredns/log/config/coredns.yml b/x-pack/filebeat/module/coredns/log/config/coredns.yml index b2f0ebe4519..be7f27f551f 100644 --- a/x-pack/filebeat/module/coredns/log/config/coredns.yml +++ b/x-pack/filebeat/module/coredns/log/config/coredns.yml @@ -3,7 +3,8 @@ paths: {{ range $i, $path := .paths }} - {{$path}} {{ end }} -tags: {{.tags}} +tags: {{.tags | tojson}} +publisher_pipeline.disable_host: {{ inList .tags "forwarded" }} processors: - add_fields: target: '' diff --git a/x-pack/filebeat/module/envoyproxy/log/config/envoyproxy.yml b/x-pack/filebeat/module/envoyproxy/log/config/envoyproxy.yml index b2f0ebe4519..be7f27f551f 100644 --- a/x-pack/filebeat/module/envoyproxy/log/config/envoyproxy.yml +++ b/x-pack/filebeat/module/envoyproxy/log/config/envoyproxy.yml @@ -3,7 +3,8 @@ paths: {{ range $i, $path := .paths }} - {{$path}} {{ end }} -tags: {{.tags}} +tags: {{.tags | tojson}} +publisher_pipeline.disable_host: {{ inList .tags "forwarded" }} processors: - add_fields: target: ''