From fc5189c1b33b7c717bfe3d618e2f41a208b9a8c0 Mon Sep 17 00:00:00 2001 From: Andrew Stucki Date: Thu, 18 Jun 2020 11:23:58 -0400 Subject: [PATCH] [Functionbeat] Add ECS categorization fields (#19174) * Add ECS categorization fields * Add changelog entry --- CHANGELOG.next.asciidoc | 2 +- .../aws/aws/transformer/transformer.go | 40 +++++++++++++++++++ .../aws/aws/transformer/transformer_test.go | 20 ++++++++++ .../provider/gcp/gcp/transformer.go | 14 +++++++ 4 files changed, 75 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index 67c04b9d771..4f7003833ab 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -505,7 +505,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d *Packetbeat* *Functionbeat* - +- Add basic ECS categorization and `cloud` fields. {pull}19174[19174] *Winlogbeat* diff --git a/x-pack/functionbeat/provider/aws/aws/transformer/transformer.go b/x-pack/functionbeat/provider/aws/aws/transformer/transformer.go index 7a488446711..bc38ed2ab2d 100644 --- a/x-pack/functionbeat/provider/aws/aws/transformer/transformer.go +++ b/x-pack/functionbeat/provider/aws/aws/transformer/transformer.go @@ -31,6 +31,12 @@ func CloudwatchLogs(request events.CloudwatchLogsData) []beat.Event { events[idx] = beat.Event{ Timestamp: time.Unix(0, logEvent.Timestamp*1000000), Fields: common.MapStr{ + "event": common.MapStr{ + "kind": "event", + }, + "cloud": common.MapStr{ + "provider": "aws", + }, "message": logEvent.Message, "id": logEvent.ID, "owner": request.Owner, @@ -50,6 +56,19 @@ func APIGatewayProxyRequest(request events.APIGatewayProxyRequest) beat.Event { return beat.Event{ Timestamp: time.Now(), Fields: common.MapStr{ + "event": common.MapStr{ + "kind": "event", + "category": []string{"network"}, + "type": []string{"connection", "protocol"}, + }, + "cloud": common.MapStr{ + "provider": "aws", + "account.id": request.RequestContext.AccountID, + }, + "network": common.MapStr{ + "transport": "tcp", + "protocol": "http", + }, "resource": request.Resource, "path": request.Path, "method": request.HTTPMethod, @@ -70,6 +89,13 @@ func KinesisEvent(request events.KinesisEvent) []beat.Event { events[idx] = beat.Event{ Timestamp: time.Now(), Fields: common.MapStr{ + "event": common.MapStr{ + "kind": "event", + }, + "cloud": common.MapStr{ + "provider": "aws", + "region": record.AwsRegion, + }, "event_id": record.EventID, "event_name": record.EventName, "event_source": record.EventSource, @@ -93,6 +119,13 @@ func CloudwatchKinesisEvent(request events.KinesisEvent, base64Encoded, compress var evts []beat.Event for _, record := range request.Records { envelopeFields := common.MapStr{ + "event": common.MapStr{ + "kind": "event", + }, + "cloud": common.MapStr{ + "provider": "aws", + "region": record.AwsRegion, + }, "event_id": record.EventID, "event_name": record.EventName, "event_source": record.EventSource, @@ -157,6 +190,13 @@ func SQS(request events.SQSEvent) []beat.Event { events[idx] = beat.Event{ Timestamp: time.Now(), Fields: common.MapStr{ + "event": common.MapStr{ + "kind": "event", + }, + "cloud": common.MapStr{ + "provider": "aws", + "region": record.AWSRegion, + }, "message_id": record.MessageId, "receipt_handle": record.ReceiptHandle, "message": record.Body, diff --git a/x-pack/functionbeat/provider/aws/aws/transformer/transformer_test.go b/x-pack/functionbeat/provider/aws/aws/transformer/transformer_test.go index 1fcdc1fc525..d96cc878c92 100644 --- a/x-pack/functionbeat/provider/aws/aws/transformer/transformer_test.go +++ b/x-pack/functionbeat/provider/aws/aws/transformer/transformer_test.go @@ -40,6 +40,12 @@ func TestCloudwatch(t *testing.T) { expectedEvent := beat.Event{ Timestamp: expectedTime, Fields: common.MapStr{ + "event": common.MapStr{ + "kind": "event", + }, + "cloud": common.MapStr{ + "provider": "aws", + }, "message": "my interesting message", "id": "1234567890123456789", "owner": "me", @@ -79,6 +85,13 @@ func TestKinesis(t *testing.T) { assert.Equal(t, 1, len(events)) fields := common.MapStr{ + "cloud": common.MapStr{ + "provider": "aws", + "region": "us-east-1", + }, + "event": common.MapStr{ + "kind": "event", + }, "event_id": "1234", "event_name": "connect", "event_source": "web", @@ -130,6 +143,13 @@ ciJ9XX0=`), assert.Equal(t, 3, len(events)) envelopeFields := common.MapStr{ + "cloud": common.MapStr{ + "provider": "aws", + "region": "us-east-1", + }, + "event": common.MapStr{ + "kind": "event", + }, "event_id": "1234", "event_name": "connect", "event_source": "web", diff --git a/x-pack/functionbeat/provider/gcp/gcp/transformer.go b/x-pack/functionbeat/provider/gcp/gcp/transformer.go index a3e0a5235d7..beb4fa7f354 100644 --- a/x-pack/functionbeat/provider/gcp/gcp/transformer.go +++ b/x-pack/functionbeat/provider/gcp/gcp/transformer.go @@ -29,6 +29,12 @@ func transformPubSub(mData *metadata.Metadata, msg pubsub.Message) (beat.Event, return beat.Event{ Timestamp: mData.Timestamp, Fields: common.MapStr{ + "event": common.MapStr{ + "kind": "event", + }, + "cloud": common.MapStr{ + "provider": "gcp", + }, "read_timestamp": time.Now(), "message": string(msg.Data), "attributes": msg.Attributes, @@ -48,6 +54,14 @@ func transformStorage(mData *metadata.Metadata, evt StorageEvent) (beat.Event, e return beat.Event{ Timestamp: mData.Timestamp, Fields: common.MapStr{ + "event": common.MapStr{ + "kind": "event", + "category": []string{"file"}, + "type": []string{"info"}, + }, + "cloud": common.MapStr{ + "provider": "gcp", + }, "read_timestamp": time.Now(), "id": mData.EventID, "resource": common.MapStr{