Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Disable host fields for "cloud", panw, cef modules #18223

Merged

Conversation

andrewkroh
Copy link
Member

@andrewkroh andrewkroh commented May 5, 2020

What does this PR do?

This changes the default configuration of Filebeat to not add host fields to events that
originated in other places. The host field is defined in ECS as "host on which the event happened" but for data pulled from cloud APIs for data forwarded to Filebeat from other sources (PANW, CEF) this host field is inaccurate.

The affected "cloud" modules are azure, aws, googlecloud, o365, and okta. By default they will
tag events with cloud. This causes the module to not add host.name at the input state. And then the default configuration for Filebeat was updated to add a when condition to the add_host_metadata processors to skip events containing the cloud tag.

For PANW and CEF when data is forwarded to Filebeat from another host/device (this is most of the time) you don't want Filebeat to add host. So by default this modules add a forwarded tag to events that behaves the same as the cloud tag. If you configure the module to not include the forwarded tag (e.g. var.tags: [my_tag]) then Filebeat will add the host.* fields.

And for PANW I added some additional static observer.* fields.

Why is it important?

We want Filebeat to follow Elastic Common Schema. And setting host with the correct value is part of that. By setting (or not setting host) we can better interpret events. Without this change the Filebeat host is being attributed as the source of many cloud based audit/login events.

Checklist

  • My code follows the style guidelines of this project
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
  • I have made corresponding change to the default configuration files
  • I have added tests that prove my fix is effective or that my feature works
  • I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

How to test this PR locally

Run this config from the x-pack/filebeat dir and verify that events do not contain host.

filebeat.modules:
- module: panw
  panos:
    var.input: file
    var.paths:
      - module/panw/panos/test/*.log
processors:
  - add_host_metadata:
      when.not.or:
        - contains.tags: cloud
        - contains.tags: forwarded
output.console.pretty: true

Related issues

Relates: #13920
Requires: #18159

@botelastic botelastic bot added the needs_team Indicates that the issue/PR needs a Team:* label label May 5, 2020
@andrewkroh andrewkroh force-pushed the feature/fb/disable-host-cloud-panw-cef branch from 54aae77 to 8b659eb Compare May 5, 2020 05:30
@elasticmachine
Copy link
Collaborator

elasticmachine commented May 5, 2020

💔 Build Failed

Pipeline View Test View Changes Artifacts preview stats

Expand to view the summary

Build stats

Test stats 🧪

Test Results
Failed 2
Passed 2121
Skipped 130
Total 2253

Test errors

Expand to view the tests failures

  • Name: Build and Test / Filebeat Mac OS X / TestGetTemplateFunctions – fileset

    • Status: FAILED
    • Age: 2
    • Duration: 0
    • Error Details: Failed
  • Name: Build and Test / Filebeat Windows / TestGetTemplateFunctions – fileset

    • Status: FAILED
    • Age: 2
    • Duration: 0
    • Error Details: Failed

Steps errors

Expand to view the steps failures

  • Name: Make -C filebeat testsuite

    • Description: make -C filebeat testsuite

    • Result: FAILURE

    • Duration: 4 min 46 sec<

    • Start Time: 2020-05-05T19:04:07.759+0000

  • Name: Mage build unitTest

    • Description: mage build unitTest

    • Result: FAILURE

    • Duration: 2 min 7 sec<

    • Start Time: 2020-05-05T19:04:59.502+0000

  • Name: Mage build unitTest

    • Description: mage build unitTest

    • Result: FAILURE

    • Duration: 4 min 21 sec<

    • Start Time: 2020-05-05T19:07:06.578+0000

Log output

Expand to view the last 100 lines of log output

[2020-05-05T19:33:31.683Z] [success] 0.49% test_xpack_modules.XPackTest.test_fileset_file_016_aws: 1.8509s
[2020-05-05T19:33:31.683Z] [success] 0.49% test_xpack_modules.XPackTest.test_fileset_file_043_aws: 1.8480s
[2020-05-05T19:33:31.683Z] [success] 0.49% test_xpack_modules.XPackTest.test_fileset_file_054_aws: 1.8479s
[2020-05-05T19:33:31.683Z] [success] 0.49% test_xpack_modules.XPackTest.test_fileset_file_037_aws: 1.8479s
[2020-05-05T19:33:31.684Z] [success] 0.49% test_xpack_modules.XPackTest.test_fileset_file_073_zeek: 1.8476s
[2020-05-05T19:33:31.684Z] [success] 0.49% test_xpack_modules.XPackTest.test_fileset_file_092_zeek: 1.8456s
[2020-05-05T19:33:31.684Z] [success] 0.49% test_xpack_modules.XPackTest.test_fileset_file_097_zeek: 1.8436s
[2020-05-05T19:33:31.684Z] [success] 0.49% test_xpack_modules.XPackTest.test_fileset_file_069_zeek: 1.8435s
[2020-05-05T19:33:31.684Z] [success] 0.49% test_xpack_modules.XPackTest.test_fileset_file_145_coredns: 1.8386s
[2020-05-05T19:33:31.684Z] [success] 0.49% test_xpack_modules.XPackTest.test_fileset_file_086_zeek: 1.8369s
[2020-05-05T19:33:31.684Z] [success] 0.48% test_xpack_modules.XPackTest.test_fileset_file_030_aws: 1.8362s
[2020-05-05T19:33:31.684Z] [success] 0.48% test_xpack_modules.XPackTest.test_fileset_file_031_aws: 1.8302s
[2020-05-05T19:33:31.684Z] [success] 0.48% test_xpack_modules.XPackTest.test_fileset_file_126_cisco: 1.8258s
[2020-05-05T19:33:31.684Z] [success] 0.48% test_xpack_modules.XPackTest.test_fileset_file_083_zeek: 1.8256s
[2020-05-05T19:33:31.684Z] [success] 0.48% test_xpack_modules.XPackTest.test_fileset_file_081_zeek: 1.8180s
[2020-05-05T19:33:31.684Z] [success] 0.48% test_xpack_modules.XPackTest.test_fileset_file_052_aws: 1.8160s
[2020-05-05T19:33:31.684Z] [success] 0.48% test_xpack_modules.XPackTest.test_fileset_file_049_aws: 1.8152s
[2020-05-05T19:33:31.684Z] [success] 0.48% test_xpack_modules.XPackTest.test_fileset_file_042_aws: 1.8140s
[2020-05-05T19:33:31.684Z] [success] 0.48% test_xpack_modules.XPackTest.test_fileset_file_088_zeek: 1.8125s
[2020-05-05T19:33:31.684Z] [success] 0.48% test_xpack_modules.XPackTest.test_fileset_file_055_aws: 1.8109s
[2020-05-05T19:33:31.684Z] [success] 0.48% test_xpack_modules.XPackTest.test_fileset_file_017_aws: 1.8103s
[2020-05-05T19:33:31.684Z] [success] 0.48% test_xpack_modules.XPackTest.test_fileset_file_076_zeek: 1.8085s
[2020-05-05T19:33:31.684Z] [success] 0.47% test_xpack_modules.XPackTest.test_fileset_file_095_zeek: 1.7940s
[2020-05-05T19:33:31.684Z] [success] 0.47% test_xpack_modules.XPackTest.test_fileset_file_045_aws: 1.7899s
[2020-05-05T19:33:31.684Z] [success] 0.47% test_xpack_modules.XPackTest.test_fileset_file_040_aws: 1.7876s
[2020-05-05T19:33:31.684Z] [success] 0.47% test_xpack_modules.XPackTest.test_fileset_file_039_aws: 1.7875s
[2020-05-05T19:33:31.684Z] [success] 0.47% test_xpack_modules.XPackTest.test_fileset_file_047_aws: 1.7853s
[2020-05-05T19:33:31.684Z] [success] 0.47% test_xpack_modules.XPackTest.test_fileset_file_050_aws: 1.7849s
[2020-05-05T19:33:31.684Z] ----------------------------------------------------------------------
[2020-05-05T19:33:31.684Z] Ran 156 tests in 378.795s
[2020-05-05T19:33:31.684Z] 
[2020-05-05T19:33:31.684Z] OK
[2020-05-05T19:33:31.948Z] >> python test: Integration Testing Complete
[2020-05-05T19:33:34.233Z] Recording test results
[2020-05-05T19:33:38.566Z] Stashed 4 file(s)
[2020-05-05T19:33:38.595Z] Archiving artifacts
[2020-05-05T19:33:39.861Z] + curl -sSLo codecov https://codecov.io/bash
[2020-05-05T19:33:40.124Z] + FILE=auditbeat/build/coverage/full.cov
[2020-05-05T19:33:40.124Z] + [ -f auditbeat/build/coverage/full.cov ]
[2020-05-05T19:33:40.124Z] + FILE=filebeat/build/coverage/full.cov
[2020-05-05T19:33:40.124Z] + [ -f filebeat/build/coverage/full.cov ]
[2020-05-05T19:33:40.124Z] + FILE=heartbeat/build/coverage/full.cov
[2020-05-05T19:33:40.124Z] + [ -f heartbeat/build/coverage/full.cov ]
[2020-05-05T19:33:40.124Z] + FILE=libbeat/build/coverage/full.cov
[2020-05-05T19:33:40.124Z] + [ -f libbeat/build/coverage/full.cov ]
[2020-05-05T19:33:40.124Z] + FILE=metricbeat/build/coverage/full.cov
[2020-05-05T19:33:40.124Z] + [ -f metricbeat/build/coverage/full.cov ]
[2020-05-05T19:33:40.124Z] + FILE=packetbeat/build/coverage/full.cov
[2020-05-05T19:33:40.124Z] + [ -f packetbeat/build/coverage/full.cov ]
[2020-05-05T19:33:40.124Z] + FILE=winlogbeat/build/coverage/full.cov
[2020-05-05T19:33:40.124Z] + [ -f winlogbeat/build/coverage/full.cov ]
[2020-05-05T19:33:40.124Z] + FILE=journalbeat/build/coverage/full.cov
[2020-05-05T19:33:40.124Z] + [ -f journalbeat/build/coverage/full.cov ]
[2020-05-05T19:33:42.453Z] Running in /var/lib/jenkins/workspace/Beats_beats-beats-mbp_PR-18223/src/github.com/elastic/beats
[2020-05-05T19:33:42.858Z] + find . -type f -name TEST*.xml -path */build/* -delete
[2020-05-05T19:33:42.875Z] Running in /var/lib/jenkins/workspace/Beats_beats-beats-mbp_PR-18223/src/github.com/elastic/beats/Lint
[2020-05-05T19:33:43.160Z] Running in /var/lib/jenkins/workspace/Beats_beats-beats-mbp_PR-18223/src/github.com/elastic/beats/Filebeat-Mac-OS-X
[2020-05-05T19:33:43.416Z] Running in /var/lib/jenkins/workspace/Beats_beats-beats-mbp_PR-18223/src/github.com/elastic/beats/Filebeat-oss
[2020-05-05T19:33:43.646Z] Running in /var/lib/jenkins/workspace/Beats_beats-beats-mbp_PR-18223/src/github.com/elastic/beats/Filebeat-Windows
[2020-05-05T19:33:43.946Z] Running in /var/lib/jenkins/workspace/Beats_beats-beats-mbp_PR-18223/src/github.com/elastic/beats/Filebeat-x-pack
[2020-05-05T19:33:44.529Z] + cat
[2020-05-05T19:33:44.529Z] + /usr/local/bin/runbld ./runbld-script
[2020-05-05T19:33:44.529Z] Picked up JAVA_TOOL_OPTIONS: -Dfile.encoding=UTF8
[2020-05-05T19:33:51.291Z] runbld>>> runbld started
[2020-05-05T19:33:51.291Z] runbld>>> 1.6.11/a66728ff8f4356963772e6e6d2069392fa06acbe
[2020-05-05T19:33:52.262Z] runbld>>> The following profiles matched the job 'Beats/beats-beats-mbp/PR-18223' in order of occurrence in the config (last value wins).
[2020-05-05T19:33:53.677Z] runbld>>> Debug logging enabled.
[2020-05-05T19:33:53.677Z] runbld>>> Storing result
[2020-05-05T19:33:53.941Z] runbld>>> Store result: created {:total 2, :successful 2, :failed 0} 1
[2020-05-05T19:33:53.941Z] runbld>>> BUILD: https://c150076387b5421f9154dfbf536e5c60.us-west1.gcp.cloud.es.io:9243/build-1587637540455/t/20200505193353-DAC8E935
[2020-05-05T19:33:53.941Z] runbld>>> Adding system facts.
[2020-05-05T19:33:54.909Z] runbld>>> Adding vcs info for the latest commit:  d08f0bb55cf2db243930c1e0a7114194d4e868f3
[2020-05-05T19:33:54.909Z] runbld>>> >>>>>>>>>>>> SCRIPT EXECUTION BEGIN >>>>>>>>>>>>
[2020-05-05T19:33:54.909Z] runbld>>> Adding /usr/lib/jvm/java-8-openjdk-amd64/bin to the path.
[2020-05-05T19:33:54.909Z] Processing JUnit reports with runbld...
[2020-05-05T19:33:54.909Z] + echo 'Processing JUnit reports with runbld...'
[2020-05-05T19:33:55.184Z] runbld>>> <<<<<<<<<<<< SCRIPT EXECUTION END <<<<<<<<<<<<
[2020-05-05T19:33:55.184Z] runbld>>> DURATION: 13ms
[2020-05-05T19:33:55.184Z] runbld>>> STDOUT: 40 bytes
[2020-05-05T19:33:55.184Z] runbld>>> STDERR: 49 bytes
[2020-05-05T19:33:55.184Z] runbld>>> WRAPPED PROCESS: SUCCESS (0)
[2020-05-05T19:33:55.184Z] runbld>>> Searching for build metadata in /var/lib/jenkins/workspace/Beats_beats-beats-mbp_PR-18223/src/github.com/elastic/beats
[2020-05-05T19:33:56.627Z] runbld>>> Storing build metadata: 
[2020-05-05T19:33:56.627Z] runbld>>> Adding test report.
[2020-05-05T19:33:56.627Z] runbld>>> Searching for junit test output files with the pattern: TEST-.*\.xml$ in: /var/lib/jenkins/workspace/Beats_beats-beats-mbp_PR-18223/src/github.com/elastic/beats
[2020-05-05T19:33:58.038Z] runbld>>> Found 6 test output files
[2020-05-05T19:33:58.652Z] runbld>>> Test output logs contained: Errors: 0 Failures: 2 Tests: 2253 Skipped: 120
[2020-05-05T19:33:58.652Z] runbld>>> Storing result
[2020-05-05T19:33:58.652Z] runbld>>> FAILURES: 2
[2020-05-05T19:33:59.243Z] runbld>>> Store result: updated {:total 2, :successful 2, :failed 0} 2
[2020-05-05T19:33:59.243Z] runbld>>> BUILD: https://c150076387b5421f9154dfbf536e5c60.us-west1.gcp.cloud.es.io:9243/build-1587637540455/t/20200505193353-DAC8E935
[2020-05-05T19:33:59.243Z] runbld>>> Email notification disabled by environment variable.
[2020-05-05T19:33:59.243Z] runbld>>> Slack notification disabled by environment variable.
[2020-05-05T19:34:07.479Z] Running on Jenkins in /var/lib/jenkins/workspace/Beats_beats-beats-mbp_PR-18223
[2020-05-05T19:34:08.630Z] [INFO] getVaultSecret: Getting secrets
[2020-05-05T19:34:09.038Z] Masking supported pattern matches of $VAULT_ADDR or $VAULT_ROLE_ID or $VAULT_SECRET_ID
[2020-05-05T19:34:10.614Z] + chmod 755 generate-build-data.sh
[2020-05-05T19:34:10.614Z] + ./generate-build-data.sh https://beats-ci.elastic.co/blue/rest/organizations/jenkins/pipelines/Beats/beats-beats-mbp/PR-18223/ https://beats-ci.elastic.co/blue/rest/organizations/jenkins/pipelines/Beats/beats-beats-mbp/PR-18223/runs/4 FAILURE 6605426
[2020-05-05T19:34:11.165Z] INFO: curl https://beats-ci.elastic.co/blue/rest/organizations/jenkins/pipelines/Beats/beats-beats-mbp/PR-18223/runs/4/steps/?limit=10000 -o steps-info.json
[2020-05-05T19:34:13.650Z] INFO: curl https://beats-ci.elastic.co/blue/rest/organizations/jenkins/pipelines/Beats/beats-beats-mbp/PR-18223/runs/4/tests/?status=FAILED -o tests-errors.json

@andrewkroh andrewkroh force-pushed the feature/fb/disable-host-cloud-panw-cef branch from 8b659eb to 88556a4 Compare May 5, 2020 05:35
@elasticmachine
Copy link
Collaborator

Pinging @elastic/siem (Team:SIEM)

@andrewkroh andrewkroh added Filebeat Filebeat review and removed needs_team Indicates that the issue/PR needs a Team:* label labels May 5, 2020
@andrewkroh andrewkroh marked this pull request as ready for review May 5, 2020 05:36
This changes the default configuration of Filebeat to not add `host` fields to events that
originated in other places. The `host` field is defined in ECS as "host on which the event happened"
but for data pulled from cloud APIs for data forwarded to Filebeat from other sources (PANW, CEF)
this `host` field is inaccurate.

The affected "cloud" modules are azure, aws, googlecloud, o365, and okta. By default they will
tag events with `cloud`. This cause the module to not add `host.name` at the input state. And then
the default configuration for Filebeat was updated to add a `when` condition to the `add_host_metadata`
processors to skip events containing the `cloud` tag.

For PANW and CEF when data is forwarded to Filebeat from another host/device (this is most of the time)
you don't want Filebeat to add `host`. So by default this modules add a `forwarded` tag to events that
behaves the same as the `cloud` tag. If you configure the module to not include the `forwarded` tag
(e.g. `var.tags: [my_tag]`) then Filebeat will add the `host.*` fields.

And for PANW I added some additional static `observer.*` fields.

Relates: elastic#13920
@andrewkroh andrewkroh force-pushed the feature/fb/disable-host-cloud-panw-cef branch from 88556a4 to f8fa355 Compare May 5, 2020 17:43
@@ -4,6 +4,9 @@ paths:
- {{$path}}
{{ end }}
exclude_files: [".gz$"]
tags: {{.tags | tojson}}
publisher_pipeline.disable_host: {{ inList .tags "cloud" }}

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

overall makes sense to me, but just wondering--shouldn't this follow the same logic as the add_host_metadata processor (check cloud || forwarded)? Just wondering since it'd mean in 8.x we could collapse this down and just standardize on "tag with forwarded to avoid the host enrichment"

@@ -13,6 +13,8 @@ var:
- name: secret_access_key
- name: session_token
- name: role_arn
- name: tags
default: [cloud]

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

also, same here, i'm thinking we should probably just tag all the resources for cloud with forwarded too, no?

@andrewstucki andrewstucki requested a review from a team May 5, 2020 19:44
@leehinman
Copy link
Contributor

I'm wondering if we need "cloud" and "forwarded", it feels odd to have 2 flags that will do the same thing. Could we have one tag "disable_host_metadata"? And then the processor template would be:

processors:
  - add_host_metadata:
      when.not:
        - contains.tags: disable_host_metadata

@andrewkroh
Copy link
Member Author

Thanks for the feedback @leehinman @andrewstucki . It sounds like there is some consensus that it would be more clear to have a single tag for indicating that the data that did not originate on "this Filebeat host". That leaves the question of what that one tag should be. I like "forwarded" more than "disable_host_metadata" because it has some meaning w.r.t. the event whereas "disable_host_metadata" is more about how Filebeat should handle the data.

If the tag were not going to be indexed in Elasticsearch then "disable_host_metadata" would be great, but I think in most cases it will end up in ES. There's no good way to guarantee that it gets dropped from the event. We could drop it in our default config but the module user might not have our default config. Besides that, we don't have a "drop_tag" processor.

So should we used forwarded as a conventional tag to indicate the data came from somewhere else?

@andrewkroh andrewkroh added the discuss Issue needs further discussion. label May 7, 2020
@leehinman
Copy link
Contributor

forwarded works for me

Copy link
Contributor

@adriansr adriansr left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@elasticmachine
Copy link
Collaborator

elasticmachine commented May 14, 2020

💚 Build Succeeded

Pipeline View Test View Changes Artifacts preview

Expand to view the summary

Build stats

Test stats 🧪

Test Results
Failed 0
Passed 2784
Skipped 418
Total 3202

@elastic elastic deleted a comment from elasticmachine May 14, 2020
@andrewkroh andrewkroh merged commit e990740 into elastic:master May 15, 2020
v1v added a commit to v1v/beats that referenced this pull request May 15, 2020
…w-oss

* upstream/master: (27 commits)
  Disable host fields for "cloud", panw, cef modules (elastic#18223)
  [docs] Rename monitoring collection from legacy internal collection to legacy collection (elastic#18504)
  Introduce auto detection of format (elastic#18095)
  Add additional fields to address issue elastic#18465 for googlecloud audit log (elastic#18472)
  Fix libbeat import path in seccomp policy template (elastic#18418)
  Address Okta input issue elastic#18530 (elastic#18534)
  [Ingest Manager] Avoid Chown on windows (elastic#18512)
  Fix Cisco ASA/FTD msgs that use a host name as NAT address (elastic#18376)
  [CI] Optimise stash/unstash performance (elastic#18473)
  Libbeat: Remove global loggers from libbeat/metric and libbeat/cloudid (elastic#18500)
  Fix PANW bad mapping of client/source and server/dest packets and bytes (elastic#18525)
  Add a file lock to the data directory on startup to prevent multiple agents. (elastic#18483)
  Followup to 12606 (elastic#18316)
  changed input from syslog to tcp/udp due to unsupported RFC (elastic#18447)
  Improve ECS field mappings in Sysmon module. (elastic#18381)
  [Elastic Agent] Cleaner output of inspect command  (elastic#18405)
  [Elastic Agent] Pick up version from libbeat (elastic#18350)
  Update communitybeats.asciidoc (elastic#18470)
  [Metricbeat] Change visualization interval from 15m to >=15m (elastic#18466)
  docs: Fix typo in kerberos docs (elastic#18503)
  ...
@andrewkroh andrewkroh added the needs_backport PR is waiting to be backported to other branches. label Jun 9, 2020
andrewkroh added a commit to andrewkroh/beats that referenced this pull request Jun 9, 2020
This changes the default configuration of Filebeat to not add `host` fields to events that
originated in other places. The `host` field is defined in ECS as "host on which the event happened"
but for data pulled from cloud APIs for data forwarded to Filebeat from other sources (PANW, CEF)
this `host` field is inaccurate.

The affected "cloud" modules are azure, aws, googlecloud, o365, and okta. By default they will
tag events with `forwarded`. This will cause the module to not add `host.name` at the input state. And then
the default configuration for Filebeat was updated to add a `when` condition to the `add_host_metadata`
processors to skip events containing the `forwarded` tag.

For PANW and CEF when data is forwarded to Filebeat from another host/device (this is most of the time)
you don't want Filebeat to add `host`. So by default this modules add a `forwarded` tag to events. If you configure the module to not include the `forwarded` tag
(e.g. `var.tags: [my_tag]`) then Filebeat will add the `host.*` fields.

And for PANW I added some additional static `observer.*` fields.

Relates: elastic#13920
(cherry picked from commit e990740)
@andrewkroh andrewkroh added v7.9.0 and removed needs_backport PR is waiting to be backported to other branches. labels Jun 9, 2020
andrewkroh added a commit that referenced this pull request Jun 9, 2020
… modules (#19074)

This changes the default configuration of Filebeat to not add `host` fields to events that
originated in other places. The `host` field is defined in ECS as "host on which the event happened"
but for data pulled from cloud APIs for data forwarded to Filebeat from other sources (PANW, CEF)
this `host` field is inaccurate.

The affected "cloud" modules are azure, aws, googlecloud, o365, and okta. By default they will
tag events with `forwarded`. This will cause the module to not add `host.name` at the input state. And then
the default configuration for Filebeat was updated to add a `when` condition to the `add_host_metadata`
processors to skip events containing the `forwarded` tag.

For PANW and CEF when data is forwarded to Filebeat from another host/device (this is most of the time)
you don't want Filebeat to add `host`. So by default this modules add a `forwarded` tag to events. If you configure the module to not include the `forwarded` tag
(e.g. `var.tags: [my_tag]`) then Filebeat will add the `host.*` fields.

And for PANW I added some additional static `observer.*` fields.

Relates: #13920
(cherry picked from commit e990740)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
discuss Issue needs further discussion. Filebeat Filebeat review v7.9.0
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants