From 8ae5ebc57d30e77619324690db368d505b89328b Mon Sep 17 00:00:00 2001 From: Adrian Serrano Date: Thu, 14 Mar 2019 14:19:54 +0100 Subject: [PATCH 1/2] Update ingest pipelines to use event.timezone Previously, `beats.timezone` was used, in master it's not available anymore. However, some ingest pipelines were still using it. --- filebeat/module/kafka/log/ingest/pipeline.json | 2 +- filebeat/module/system/auth/ingest/pipeline.json | 2 +- filebeat/module/system/syslog/ingest/pipeline.json | 2 +- x-pack/filebeat/module/iptables/log/ingest/pipeline.json | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/filebeat/module/kafka/log/ingest/pipeline.json b/filebeat/module/kafka/log/ingest/pipeline.json index cde66f21dfc..5039782341d 100644 --- a/filebeat/module/kafka/log/ingest/pipeline.json +++ b/filebeat/module/kafka/log/ingest/pipeline.json @@ -62,7 +62,7 @@ "field": "kafka.log.timestamp", "target_field": "@timestamp", "formats": ["yyyy-MM-dd HH:mm:ss,SSS"], - {< if .convert_timezone >}"timezone": "{{ beat.timezone }}",{< end >} + {< if .convert_timezone >}"timezone": "{{ event.timezone }}",{< end >} "ignore_failure": true } }, diff --git a/filebeat/module/system/auth/ingest/pipeline.json b/filebeat/module/system/auth/ingest/pipeline.json index 1ba82b5e117..c6b91e067ac 100644 --- a/filebeat/module/system/auth/ingest/pipeline.json +++ b/filebeat/module/system/auth/ingest/pipeline.json @@ -46,7 +46,7 @@ "MMM d HH:mm:ss", "MMM dd HH:mm:ss" ], - {< if .convert_timezone >}"timezone": "{{ beat.timezone }}",{< end >} + {< if .convert_timezone >}"timezone": "{{ event.timezone }}",{< end >} "ignore_failure": true } }, diff --git a/filebeat/module/system/syslog/ingest/pipeline.json b/filebeat/module/system/syslog/ingest/pipeline.json index 1d5f93d724f..37d0c310fcd 100644 --- a/filebeat/module/system/syslog/ingest/pipeline.json +++ b/filebeat/module/system/syslog/ingest/pipeline.json @@ -36,7 +36,7 @@ "MMM dd HH:mm:ss", "yyyy-MM-dd'T'HH:mm:ss.SSSSSSZZ" ], - {< if .convert_timezone >}"timezone": "{{ beat.timezone }}",{< end >} + {< if .convert_timezone >}"timezone": "{{ event.timezone }}",{< end >} "ignore_failure": true } }, diff --git a/x-pack/filebeat/module/iptables/log/ingest/pipeline.json b/x-pack/filebeat/module/iptables/log/ingest/pipeline.json index 1678df94c5e..21b9cb625cc 100644 --- a/x-pack/filebeat/module/iptables/log/ingest/pipeline.json +++ b/x-pack/filebeat/module/iptables/log/ingest/pipeline.json @@ -64,7 +64,7 @@ "date": { "field": "iptables.raw_date", "ignore_failure": true, - {< if .convert_timezone >}"timezone": "{{ beat.timezone }}",{< end >} + {< if .convert_timezone >}"timezone": "{{ event.timezone }}",{< end >} "formats": [ "MMM d HH:mm:ss", "MMM dd HH:mm:ss" From 37a545b08ef4fb944eb8bee407eb26a8f5b6df89 Mon Sep 17 00:00:00 2001 From: Adrian Serrano Date: Thu, 14 Mar 2019 16:09:50 +0100 Subject: [PATCH 2/2] Fix unit test --- filebeat/fileset/fileset_test.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/filebeat/fileset/fileset_test.go b/filebeat/fileset/fileset_test.go index f3b398c8612..1b195d89873 100644 --- a/filebeat/fileset/fileset_test.go +++ b/filebeat/fileset/fileset_test.go @@ -269,9 +269,9 @@ func TestGetPipelineConvertTS(t *testing.T) { marshaled, err := json.Marshal(pipeline.contents) require.NoError(t, err) if cfg.Timezone { - assert.Contains(t, string(marshaled), "beat.timezone") + assert.Contains(t, string(marshaled), "event.timezone") } else { - assert.NotContains(t, string(marshaled), "beat.timezone") + assert.NotContains(t, string(marshaled), "event.timezone") } }) }