Non-breaking adjustment of osquery Filebeat module to ECS

CHANGELOG.next.asciidoc

@@ -124,6 +124,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 - Add support for ssl_request_log in apache2 module. {issue}8088[8088] {pull}9833[9833]
 - Add support for iis 7.5 log format. {issue}9753[9753] {pull}9967[9967]
 - Add service.type field to all Modules. By default the field is set with the module name. It can be overwritten with `service.type` config. {pull}10042[10042]
+- Copy a few `osquery.result.*` fields to map to ECS. {pull}10088[10088]
 
 *Heartbeat*
 

filebeat/docs/fields.asciidoc

@@ -10054,6 +10054,8 @@ Unix timestamp of the event, in seconds since the epoch. Used for computing the
 *`osquery.result.calendar_time`*::
 +
 --
+type: keyword
+
 String representation of the collection time, as formatted by osquery.
 
 

filebeat/module/osquery/result/_meta/fields.yml

@@ -22,6 +22,6 @@
       description: >
         Unix timestamp of the event, in seconds since the epoch. Used for computing the `@timestamp` column.
     - name: calendar_time
-      tupe: keyword
+      type: keyword
       description: >
         String representation of the collection time, as formatted by osquery.

filebeat/module/osquery/result/ingest/pipeline.json

@@ -4,7 +4,7 @@
     {
       "rename": {
         "field": "@timestamp",
-        "target_field": "read_timestamp"
+        "target_field": "event.created"
       }
     }, {
       "date": {
@@ -42,6 +42,31 @@
             "target_field": "osquery.result.calendar_time",
             "ignore_missing": true
         }
+    },
+
+    {
+        "convert": {
+            "field": "osquery.result.decorations.host_uuid",
+            "target_field": "host.id",
+            "type": "string",
+            "ignore_missing": true
+        }
+    },
+    {
+        "convert": {
+            "field": "osquery.result.host_identifier",
+            "target_field": "host.hostname",
+            "type": "string",
+            "ignore_missing": true
+        }
+    },
+    {
+        "convert": {
+            "field": "osquery.result.decorations.username",
+            "target_field": "user.name",
+            "type": "string",
+            "ignore_missing": true
+        }
     }
   ],
   "on_failure" : [{

filebeat/module/osquery/result/test/test.log

@@ -1 +1,2 @@
 {"name":"pack_it-compliance_mounts","hostIdentifier":"192-168-0-4.rdsnet.ro","calendarTime":"Thu Dec 28 14:40:08 2017 UTC","unixTime":"1514472008","epoch":"0","counter":"1","decorations":{"host_uuid":"4AB2906D-5516-5794-AF54-86D1D7F533F3","username":"tsg"},"columns":{"blocks":"122061322","blocks_available":"75966945","blocks_free":"121274885","blocks_size":"4096","device":"\/dev\/disk1s4","device_alias":"\/dev\/disk1s4","flags":"345018372","inodes":"9223372036854775807","inodes_free":"9223372036854775804","path":"\/private\/var\/vm","type":"apfs"},"action":"removed"}
+{"name":"pack_it-compliance_mounts","calendarTime":"Thu Dec 28 14:40:18 2017 UTC","unixTime":"1514472018","epoch":"0","counter":"1","columns":{"blocks":"122061322","blocks_available":"75966945","blocks_free":"121274885","blocks_size":"4096","device":"\/dev\/disk1s4","device_alias":"\/dev\/disk1s4","flags":"345018372","inodes":"9223372036854775807","inodes_free":"9223372036854775804","path":"\/private\/var\/vm","type":"apfs"},"action":"removed"}

filebeat/module/osquery/result/test/test.log-expected.json

@@ -5,6 +5,8 @@
         "event.dataset": "osquery.result",
         "event.module": "osquery",
         "fileset.name": "result",
+        "host.hostname": "192-168-0-4.rdsnet.ro",
+        "host.id": "4AB2906D-5516-5794-AF54-86D1D7F533F3",
         "input.type": "log",
         "log.offset": 0,
         "osquery.result.action": "removed",
@@ -27,6 +29,34 @@
         "osquery.result.host_identifier": "192-168-0-4.rdsnet.ro",
         "osquery.result.name": "pack_it-compliance_mounts",
         "osquery.result.unix_time": "1514472008",
+        "service.type": "osquery",
+        "user.name": "tsg"
+    },
+    {
+        "@timestamp": "2017-12-28T14:40:18.000Z",
+        "ecs.version": "1.0.0-beta2",
+        "event.dataset": "osquery.result",
+        "event.module": "osquery",
+        "fileset.name": "result",
+        "input.type": "log",
+        "log.offset": 574,
+        "osquery.result.action": "removed",
+        "osquery.result.calendar_time": "Thu Dec 28 14:40:18 2017 UTC",
+        "osquery.result.columns.blocks": "122061322",
+        "osquery.result.columns.blocks_available": "75966945",
+        "osquery.result.columns.blocks_free": "121274885",
+        "osquery.result.columns.blocks_size": "4096",
+        "osquery.result.columns.device": "/dev/disk1s4",
+        "osquery.result.columns.device_alias": "/dev/disk1s4",
+        "osquery.result.columns.flags": "345018372",
+        "osquery.result.columns.inodes": "9223372036854775807",
+        "osquery.result.columns.inodes_free": "9223372036854775804",
+        "osquery.result.columns.path": "/private/var/vm",
+        "osquery.result.columns.type": "apfs",
+        "osquery.result.counter": "1",
+        "osquery.result.epoch": "0",
+        "osquery.result.name": "pack_it-compliance_mounts",
+        "osquery.result.unix_time": "1514472018",
         "service.type": "osquery"
     }
 ]