-
Notifications
You must be signed in to change notification settings - Fork 4.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[libbeat] Fix add_labels flattening of arrays values #29211
[libbeat] Fix add_labels flattening of arrays values #29211
Conversation
Pinging @elastic/security-external-integrations (Team:Security-External Integrations) |
Pinging @elastic/elastic-agent-data-plane (Team:Elastic-Agent-Data-Plane) |
The processor was not working as described in the docs. For example: ```yaml processors: - add_labels: labels: number: 1 with.dots: test nested: with.dots: nested array: - do - re - with.field: mi ``` ```json { "labels": { "array": [ "do", "re", { "with": { "field": "mi" } } ], "nested.with.dots": "nested", "number": 1, "with.dots": "test" } ``` ```json { "labels": { "number": 1, "with.dots": "test", "nested.with.dots": "nested", "array.0": "do", "array.1": "re", "array.2.with.field": "mi" } } ```
e1dfc55
to
4a62f82
Compare
💚 Build Succeeded
Expand to view the summary
Build stats
Test stats 🧪
💚 Flaky test reportTests succeeded. 🤖 GitHub commentsTo re-run your PR in the CI, just comment with:
|
* Fix add_labels flattening of arrays values The processor was not working as described in the docs. For example: ```yaml processors: - add_labels: labels: number: 1 with.dots: test nested: with.dots: nested array: - do - re - with.field: mi ``` ```json { "labels": { "array": [ "do", "re", { "with": { "field": "mi" } } ], "nested.with.dots": "nested", "number": 1, "with.dots": "test" } ``` ```json { "labels": { "number": 1, "with.dots": "test", "nested.with.dots": "nested", "array.0": "do", "array.1": "re", "array.2.with.field": "mi" } } ``` * Expose ucfg FlattenedKeys() in common.Config (cherry picked from commit 1dd9714)
* Fix add_labels flattening of arrays values The processor was not working as described in the docs. For example: ```yaml processors: - add_labels: labels: number: 1 with.dots: test nested: with.dots: nested array: - do - re - with.field: mi ``` ```json { "labels": { "array": [ "do", "re", { "with": { "field": "mi" } } ], "nested.with.dots": "nested", "number": 1, "with.dots": "test" } ``` ```json { "labels": { "number": 1, "with.dots": "test", "nested.with.dots": "nested", "array.0": "do", "array.1": "re", "array.2.with.field": "mi" } } ``` * Expose ucfg FlattenedKeys() in common.Config (cherry picked from commit 1dd9714)
* upstream/master: [libbeat] Fix add_labels flattening of arrays values (elastic#29211) Change elastic-agent pprof default to false (elastic#29155) elastic#28472 fix flaky tests in libbeat fmtstr to use time.UTC instead of time.Local (elastic#28473) Adopt `parsers` in Filebeat's journald input (elastic#29070) [Elastic Agent] Add process error handling guidelines (elastic#29152) winlogbeat/sys/winevent: use reflect IsZero method (elastic#29190) Remove Journalbeat (elastic#29131) Add note that there is no warranty or support for generator code (elastic#28797) packetbeat: preparation for npcap addition (elastic#29017) Use the generic helper for opening file to read in filestream (elastic#29180) Workflow for macos (elastic#29174) Fix `decode_json_fields` processor to always add error key (elastic#29107)
* Fix add_labels flattening of arrays values The processor was not working as described in the docs. For example: ```yaml processors: - add_labels: labels: number: 1 with.dots: test nested: with.dots: nested array: - do - re - with.field: mi ``` ```json { "labels": { "array": [ "do", "re", { "with": { "field": "mi" } } ], "nested.with.dots": "nested", "number": 1, "with.dots": "test" } ``` ```json { "labels": { "number": 1, "with.dots": "test", "nested.with.dots": "nested", "array.0": "do", "array.1": "re", "array.2.with.field": "mi" } } ``` * Expose ucfg FlattenedKeys() in common.Config (cherry picked from commit 1dd9714) Co-authored-by: Andrew Kroh <andrew.kroh@elastic.co>
* Fix add_labels flattening of arrays values The processor was not working as described in the docs. For example: ```yaml processors: - add_labels: labels: number: 1 with.dots: test nested: with.dots: nested array: - do - re - with.field: mi ``` ```json { "labels": { "array": [ "do", "re", { "with": { "field": "mi" } } ], "nested.with.dots": "nested", "number": 1, "with.dots": "test" } ``` ```json { "labels": { "number": 1, "with.dots": "test", "nested.with.dots": "nested", "array.0": "do", "array.1": "re", "array.2.with.field": "mi" } } ``` * Expose ucfg FlattenedKeys() in common.Config (cherry picked from commit 1dd9714) Co-authored-by: Andrew Kroh <andrew.kroh@elastic.co>
What does this PR do?
The processor was not working as described in the docs. For example:
Why is it important?
The generated values to not align with the docs or how
labels
is described in ECS.Checklist
CHANGELOG.next.asciidoc
orCHANGELOG-developer.next.asciidoc
.