Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Cherry-pick #16307 to 7.x: [Filebeat] Improve ECS field mappings in aws module #16478

Merged
merged 1 commit into from
Feb 21, 2020
Merged

Cherry-pick #16307 to 7.x: [Filebeat] Improve ECS field mappings in aws module #16478

merged 1 commit into from
Feb 21, 2020

Conversation

leehinman
Copy link
Contributor

Cherry-pick of PR #16307 to 7.x branch. Original message:

  • elb fileset

    • cloud.provider
    • event.category
    • event.kind
    • event.outcome
    • http.response.status_code, convert to long
    • http.request.method, lowercase
    • tracing.trace.id

  • s3access fileset

    • client.address
    • client.ip
    • geo
    • client.user.id
    • cloud.provider
    • event.action
    • event.code
    • event.duration
    • event.id
    • event.kind
    • event.outcome
    • http.request.referrer
    • http.response.status_code
    • related.user
    • user_agent

  • vpcflow fileset

    • cloud.provider
    • cloud.account.id
    • cloud.instance.id
    • event.kind

Closes #16154

What does this PR do?

Why is it important?

Checklist

  • My code follows the style guidelines of this project
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
  • I have made corresponding change to the default configuration files
  • I have added tests that prove my fix is effective or that my feature works

Author's Checklist

  • [ ]

How to test this PR locally

Related issues

Use cases

Screenshots

Logs

@leehinman
[Filebeat] Improve ECS field mappings in aws module (elastic#16307)
ad0098a 
* Improve ECS field mappings in aws module

- elb fileset
  + cloud.provider
  + event.category
  + event.kind
  + event.outcome
  + http.response.status_code, convert to long
  + http.request.method, lowercase
  + tracing.trace.id

- s3access fileset
  + client.address
  + client.ip
  + geo
  + client.user.id
  + cloud.provider
  + event.action
  + event.code
  + event.duration
  + event.id
  + event.kind
  + event.outcome
  + http.request.referrer
  + http.response.status_code
  + related.ip
  + related.user
  + user_agent

- vpcflow fileset
  + cloud.provider
  + cloud.account.id
  + cloud.instance.id
  + event.kind

Closes elastic#16154

(cherry picked from commit 913f7ee)
@leehinman leehinman requested a review from a team as a code owner February 21, 2020 03:04
@elasticmachine
Copy link
Collaborator

Pinging @elastic/siem (Team:SIEM)

@leehinman leehinman merged commit 595cc41 into elastic:7.x Feb 21, 2020
@leehinman leehinman deleted the backport_16307_7.x branch February 21, 2020 14:51
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@kaiyan-sheng kaiyan-sheng kaiyan-sheng approved these changes

@andrewkroh andrewkroh andrewkroh approved these changes

Assignees
No one assigned
Labels
backport review
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@leehinman @elasticmachine @andrewkroh @kaiyan-sheng