Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Filebeat] Pass-thru other panw.panos log types #19375

Merged
merged 2 commits into from
Jun 26, 2020
Merged

[Filebeat] Pass-thru other panw.panos log types #19375

merged 2 commits into from
Jun 26, 2020

Conversation

andrewkroh
Copy link
Member

What does this PR do?

This removes the drop processor from the ingest node pipeline that drops events other than THREAT and TRAFFIC.
This way we can retain the other log data but don't necessarily handle the parsing of it.

Why is it important?

We want to keep data from panos even if the messages are not explicitly handled by the module. The data may not have all the ECS mappings, but at least it won't be lost. #15603 tracks adding parsing support for additional message types.

Checklist

  • My code follows the style guidelines of this project
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
  • I have made corresponding change to the default configuration files
  • I have added tests that prove my fix is effective or that my feature works
  • I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Related issues

@botelastic botelastic bot added the needs_team Indicates that the issue/PR needs a Team:* label label Jun 24, 2020
@andrewkroh
Pass-thru other panw.panos log types
09bf7a6 
This removes the drop processor from the ingest node pipeline that drops events other than THREAT and TRAFFIC.
This way we can retain the other log data but don't necessarily handle the parsing of it.

Closes elastic#16815
@andrewkroh andrewkroh added enhancement Filebeat Filebeat needs_backport PR is waiting to be backported to other branches. review Team:SIEM labels Jun 24, 2020
@botelastic botelastic bot removed the needs_team Indicates that the issue/PR needs a Team:* label label Jun 24, 2020
@andrewkroh andrewkroh marked this pull request as ready for review June 24, 2020 17:55
@elasticmachine
Copy link
Collaborator

Pinging @elastic/siem (Team:SIEM)

@andrewkroh andrewkroh changed the title Pass-thru other panw.panos log types [Filebeat] Pass-thru other panw.panos log types Jun 24, 2020
@elasticmachine
Copy link
Collaborator

elasticmachine commented Jun 24, 2020 •
edited
Loading

💚 Build Succeeded

Pipeline View Test View Changes Artifacts preview

Expand to view the summary

Build stats

  • Build Cause: [Pull request #19375 updated]

  • Start Time: 2020-06-24T17:56:20.581+0000

  • Duration: 55 min 36 sec

Test stats 🧪

Test Results
Failed 0
Passed 2350
Skipped 382
Total 2732

leehinman
leehinman approved these changes Jun 25, 2020
View reviewed changes
Copy link
Contributor

@leehinman leehinman left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@andrewkroh andrewkroh merged commit 53b32f9 into elastic:master Jun 26, 2020
@andrewkroh andrewkroh mentioned this pull request Jun 26, 2020
Merged
6 tasks
@andrewkroh andrewkroh added v7.9.0 and removed needs_backport PR is waiting to be backported to other branches. labels Jun 26, 2020
andrewkroh added a commit to andrewkroh/beats that referenced this pull request Jul 14, 2020
@andrewkroh
Pass-thru other panw.panos log types (elastic#19375)
f19ac0f 
This removes the drop processor from the ingest node pipeline that drops events other than THREAT and TRAFFIC.
This way we can retain the other log data but don't necessarily handle the parsing of it.

Closes elastic#16815

(cherry picked from commit 53b32f9)
andrewkroh added a commit that referenced this pull request Jul 14, 2020
@andrewkroh
Pass-thru other panw.panos log types (#19375) (#19473)
b9e246e 
This removes the drop processor from the ingest node pipeline that drops events other than THREAT and TRAFFIC.
This way we can retain the other log data but don't necessarily handle the parsing of it.

Closes #16815

(cherry picked from commit 53b32f9)
melchiormoulin pushed a commit to melchiormoulin/beats that referenced this pull request Oct 14, 2020
@andrewkroh @melchiormoulin
Pass-thru other panw.panos log types (elastic#19375)
03718c7 
This removes the drop processor from the ingest node pipeline that drops events other than THREAT and TRAFFIC.
This way we can retain the other log data but don't necessarily handle the parsing of it.

Closes elastic#16815
@willemdh willemdh mentioned this pull request Dec 17, 2020
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@leehinman leehinman leehinman approved these changes

Assignees
No one assigned
Labels
enhancement Filebeat Filebeat review v7.9.0
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

[Filebeat] PANW Module - Pass-through other log types
3 participants
@andrewkroh @elasticmachine @leehinman