[Functionbeat] Add ECS categorization fields (#19174)

* Add ECS categorization fields * Add changelog entry
elastic · Jun 18, 2020 · fc5189c · fc5189c
1 parent e465e96
commit fc5189c
Show file tree

Hide file tree

Showing 4 changed files with 75 additions and 1 deletion.
diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
@@ -505,7 +505,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 *Packetbeat*
 
 *Functionbeat*
-
+- Add basic ECS categorization and `cloud` fields. {pull}19174[19174]
 
 *Winlogbeat*
 

diff --git a/x-pack/functionbeat/provider/aws/aws/transformer/transformer.go b/x-pack/functionbeat/provider/aws/aws/transformer/transformer.go
@@ -31,6 +31,12 @@ func CloudwatchLogs(request events.CloudwatchLogsData) []beat.Event {
  events[idx] = beat.Event{
  Timestamp: time.Unix(0, logEvent.Timestamp*1000000),
  Fields: common.MapStr{
+ "event": common.MapStr{
+ "kind": "event",
+ },
+ "cloud": common.MapStr{
+ "provider": "aws",
+ },
  "message": logEvent.Message,
  "id": logEvent.ID,
  "owner": request.Owner,
@@ -50,6 +56,19 @@ func APIGatewayProxyRequest(request events.APIGatewayProxyRequest) beat.Event {
  return beat.Event{
  Timestamp: time.Now(),
  Fields: common.MapStr{
+ "event": common.MapStr{
+ "kind": "event",
+ "category": []string{"network"},
+ "type": []string{"connection", "protocol"},
+ },
+ "cloud": common.MapStr{
+ "provider": "aws",
+ "account.id": request.RequestContext.AccountID,
+ },
+ "network": common.MapStr{
+ "transport": "tcp",
+ "protocol": "http",
+ },
  "resource": request.Resource,
  "path": request.Path,
  "method": request.HTTPMethod,
@@ -70,6 +89,13 @@ func KinesisEvent(request events.KinesisEvent) []beat.Event {
  events[idx] = beat.Event{
  Timestamp: time.Now(),
  Fields: common.MapStr{
+ "event": common.MapStr{
+ "kind": "event",
+ },
+ "cloud": common.MapStr{
+ "provider": "aws",
+ "region": record.AwsRegion,
+ },
  "event_id": record.EventID,
  "event_name": record.EventName,
  "event_source": record.EventSource,
@@ -93,6 +119,13 @@ func CloudwatchKinesisEvent(request events.KinesisEvent, base64Encoded, compress
  var evts []beat.Event
  for _, record := range request.Records {
  envelopeFields := common.MapStr{
+ "event": common.MapStr{
+ "kind": "event",
+ },
+ "cloud": common.MapStr{
+ "provider": "aws",
+ "region": record.AwsRegion,
+ },
  "event_id": record.EventID,
  "event_name": record.EventName,
  "event_source": record.EventSource,
@@ -157,6 +190,13 @@ func SQS(request events.SQSEvent) []beat.Event {
  events[idx] = beat.Event{
  Timestamp: time.Now(),
  Fields: common.MapStr{
+ "event": common.MapStr{
+ "kind": "event",
+ },
+ "cloud": common.MapStr{
+ "provider": "aws",
+ "region": record.AWSRegion,
+ },
  "message_id": record.MessageId,
  "receipt_handle": record.ReceiptHandle,
  "message": record.Body,

diff --git a/x-pack/functionbeat/provider/aws/aws/transformer/transformer_test.go b/x-pack/functionbeat/provider/aws/aws/transformer/transformer_test.go
@@ -40,6 +40,12 @@ func TestCloudwatch(t *testing.T) {
  expectedEvent := beat.Event{
  Timestamp: expectedTime,
  Fields: common.MapStr{
+ "event": common.MapStr{
+ "kind": "event",
+ },
+ "cloud": common.MapStr{
+ "provider": "aws",
+ },
  "message": "my interesting message",
  "id": "1234567890123456789",
  "owner": "me",
@@ -79,6 +85,13 @@ func TestKinesis(t *testing.T) {
  assert.Equal(t, 1, len(events))
 
  fields := common.MapStr{
+ "cloud": common.MapStr{
+ "provider": "aws",
+ "region": "us-east-1",
+ },
+ "event": common.MapStr{
+ "kind": "event",
+ },
  "event_id": "1234",
  "event_name": "connect",
  "event_source": "web",
@@ -130,6 +143,13 @@ ciJ9XX0=`),
  assert.Equal(t, 3, len(events))
 
  envelopeFields := common.MapStr{
+ "cloud": common.MapStr{
+ "provider": "aws",
+ "region": "us-east-1",
+ },
+ "event": common.MapStr{
+ "kind": "event",
+ },
  "event_id": "1234",
  "event_name": "connect",
  "event_source": "web",

diff --git a/x-pack/functionbeat/provider/gcp/gcp/transformer.go b/x-pack/functionbeat/provider/gcp/gcp/transformer.go
@@ -29,6 +29,12 @@ func transformPubSub(mData *metadata.Metadata, msg pubsub.Message) (beat.Event,
  return beat.Event{
  Timestamp: mData.Timestamp,
  Fields: common.MapStr{
+ "event": common.MapStr{
+ "kind": "event",
+ },
+ "cloud": common.MapStr{
+ "provider": "gcp",
+ },
  "read_timestamp": time.Now(),
  "message": string(msg.Data),
  "attributes": msg.Attributes,
@@ -48,6 +54,14 @@ func transformStorage(mData *metadata.Metadata, evt StorageEvent) (beat.Event, e
  return beat.Event{
  Timestamp: mData.Timestamp,
  Fields: common.MapStr{
+ "event": common.MapStr{
+ "kind": "event",
+ "category": []string{"file"},
+ "type": []string{"info"},
+ },
+ "cloud": common.MapStr{
+ "provider": "gcp",
+ },
  "read_timestamp": time.Now(),
  "id": mData.EventID,
  "resource": common.MapStr{