diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index e7b38b33bcd..d80b480f596 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -165,6 +165,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d - Fix `cisco` asa and ftd parsing of messages 106102 and 106103. {pull}20469[20469] - Fix event.kind for system/syslog pipeline {issue}20365[20365] {pull}20390[20390] - Fix event.type for zeek/ssl and duplicate event.category for zeek/connection {pull}20696[20696] +- Add check for empty values in azure module. {pull}24156[24156] *Heartbeat* diff --git a/x-pack/filebeat/input/azureeventhub/config.go b/x-pack/filebeat/input/azureeventhub/config.go index 68ad8d109e0..e24f3f2b0f6 100644 --- a/x-pack/filebeat/input/azureeventhub/config.go +++ b/x-pack/filebeat/input/azureeventhub/config.go @@ -33,7 +33,7 @@ func (conf *azureInputConfig) Validate() error { return errors.New("no event hub name configured") } if conf.SAName == "" || conf.SAKey == "" { - return errors.New("missing storage account information") + return errors.New("no storage account or storage account key configured") } if conf.SAContainer == "" { conf.SAContainer = fmt.Sprintf("%s-%s", ephContainerName, conf.EventHubName) diff --git a/x-pack/filebeat/module/azure/activitylogs/config/azure-eventhub.yml b/x-pack/filebeat/module/azure/activitylogs/config/azure-eventhub.yml index 29e6d770780..a0a3907341d 100644 --- a/x-pack/filebeat/module/azure/activitylogs/config/azure-eventhub.yml +++ b/x-pack/filebeat/module/azure/activitylogs/config/azure-eventhub.yml @@ -1,11 +1,29 @@ type: azure-eventhub -connection_string: {{ .connection_string }} +{{ if .eventhub }} eventhub: {{ .eventhub }} +storage_account_container: filebeat-activitylogs-{{ .eventhub }} +{{ end }} + +{{ if .connection_string }} +connection_string: {{ .connection_string }} +{{ end }} + +{{ if .consumer_group }} consumer_group: {{ .consumer_group }} +{{ end }} + +{{ if .storage_account }} storage_account: {{ .storage_account }} +{{ end }} + +{{ if .storage_account_key }} storage_account_key: {{ .storage_account_key }} +{{ end }} + +{{ if .resource_manager_endpoint }} resource_manager_endpoint: {{ .resource_manager_endpoint }} -storage_account_container: filebeat-activitylogs-{{ .eventhub }} +{{ end }} + tags: {{.tags | tojson}} publisher_pipeline.disable_host: {{ inList .tags "forwarded" }} diff --git a/x-pack/filebeat/module/azure/auditlogs/config/azure-eventhub.yml b/x-pack/filebeat/module/azure/auditlogs/config/azure-eventhub.yml index f7894a5c3bf..e9abb1d0853 100644 --- a/x-pack/filebeat/module/azure/auditlogs/config/azure-eventhub.yml +++ b/x-pack/filebeat/module/azure/auditlogs/config/azure-eventhub.yml @@ -1,11 +1,29 @@ type: azure-eventhub -connection_string: {{ .connection_string }} +{{ if .eventhub }} eventhub: {{ .eventhub }} +storage_account_container: filebeat-auditlogs-{{ .eventhub }} +{{ end }} + +{{ if .connection_string }} +connection_string: {{ .connection_string }} +{{ end }} + +{{ if .consumer_group }} consumer_group: {{ .consumer_group }} +{{ end }} + +{{ if .storage_account }} storage_account: {{ .storage_account }} +{{ end }} + +{{ if .storage_account_key }} storage_account_key: {{ .storage_account_key }} +{{ end }} + +{{ if .resource_manager_endpoint }} resource_manager_endpoint: {{ .resource_manager_endpoint }} -storage_account_container: filebeat-auditlogs-{{ .eventhub }} +{{ end }} + tags: {{.tags | tojson}} publisher_pipeline.disable_host: {{ inList .tags "forwarded" }} processors: diff --git a/x-pack/filebeat/module/azure/platformlogs/config/azure-eventhub.yml b/x-pack/filebeat/module/azure/platformlogs/config/azure-eventhub.yml index 496480aa1d0..cb27166a0c9 100644 --- a/x-pack/filebeat/module/azure/platformlogs/config/azure-eventhub.yml +++ b/x-pack/filebeat/module/azure/platformlogs/config/azure-eventhub.yml @@ -1,11 +1,29 @@ type: azure-eventhub -connection_string: {{ .connection_string }} +{{ if .eventhub }} eventhub: {{ .eventhub }} +storage_account_container: filebeat-platformlogs-{{ .eventhub }} +{{ end }} + +{{ if .connection_string }} +connection_string: {{ .connection_string }} +{{ end }} + +{{ if .consumer_group }} consumer_group: {{ .consumer_group }} +{{ end }} + +{{ if .storage_account }} storage_account: {{ .storage_account }} +{{ end }} + +{{ if .storage_account_key }} storage_account_key: {{ .storage_account_key }} +{{ end }} + +{{ if .resource_manager_endpoint }} resource_manager_endpoint: {{ .resource_manager_endpoint }} -storage_account_container: filebeat-platformlogs-{{ .eventhub }} +{{ end }} + tags: {{.tags | tojson}} publisher_pipeline.disable_host: {{ inList .tags "forwarded" }} diff --git a/x-pack/filebeat/module/azure/signinlogs/config/azure-eventhub.yml b/x-pack/filebeat/module/azure/signinlogs/config/azure-eventhub.yml index b779113753b..43e7240e353 100644 --- a/x-pack/filebeat/module/azure/signinlogs/config/azure-eventhub.yml +++ b/x-pack/filebeat/module/azure/signinlogs/config/azure-eventhub.yml @@ -1,11 +1,29 @@ type: azure-eventhub -connection_string: {{ .connection_string }} +{{ if .eventhub }} eventhub: {{ .eventhub }} +storage_account_container: filebeat-signinlogs-{{ .eventhub }} +{{ end }} + +{{ if .connection_string }} +connection_string: {{ .connection_string }} +{{ end }} + +{{ if .consumer_group }} consumer_group: {{ .consumer_group }} +{{ end }} + +{{ if .storage_account }} storage_account: {{ .storage_account }} +{{ end }} + +{{ if .storage_account_key }} storage_account_key: {{ .storage_account_key }} +{{ end }} + +{{ if .resource_manager_endpoint }} resource_manager_endpoint: {{ .resource_manager_endpoint }} -storage_account_container: filebeat-signinlogs-{{ .eventhub }} +{{ end }} + tags: {{.tags | tojson}} publisher_pipeline.disable_host: {{ inList .tags "forwarded" }} processors: