Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

filebeat,x-pack/filebeat: prevent master=>event.original rename failures #39588

Merged
merged 3 commits into from
May 17, 2024
Merged

filebeat,x-pack/filebeat: prevent master=>event.original rename failures #39588

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
0e8f033
filebeat,x-pack/filebeat: prevent master=>event.original rename failu…
efd6 May 16, 2024
700def6
filebeat,x-pack/filebeat: prevent master=>event.original rename failu…
efd6 May 16, 2024
69f06d8
add changelog pr number
efd6 May 16, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions CHANGELOG.next.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -271,6 +271,8 @@ https://github.com/elastic/beats/compare/v8.8.1\...main[Check the HEAD diff]
- Improve logging of request and response with request trace logging in error conditions. {pull}39455[39455]
- Add HTTP metrics to CEL input. {issue}39501[39501] {pull}39503[39503]
- Add default user-agent to CEL HTTP requests. {issue}39502[39502] {pull}39587[39587]
- Improve reindexing support in security module pipelines. {issue}38224[38224] {pull}[]
- Improve reindexing support in security module pipelines. {issue}38224[38224] {pull}39588[39588]

*Auditbeat*

Expand Down
2 changes: 2 additions & 0 deletions filebeat/module/santa/log/ingest/pipeline.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,8 @@ processors:
- rename:
field: message
target_field: event.original
ignore_missing: true
if: ctx.event?.original == null
- date:
field: process.start
target_field: process.start
Expand Down
1 change: 1 addition & 0 deletions x-pack/filebeat/module/checkpoint/firewall/ingest/pipeline.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,7 @@ processors:
field: message
target_field: event.original
ignore_missing: true
if: ctx.event?.original == null
- grok:
field: event.original
patterns:
Expand Down
1 change: 1 addition & 0 deletions x-pack/filebeat/module/cisco/umbrella/ingest/pipeline.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,7 @@ processors:
- set:
field: event.original
value: "{{message}}"
if: ctx.event?.original == null
############
# DNS Logs #
############
Expand Down
1 change: 1 addition & 0 deletions x-pack/filebeat/module/coredns/log/ingest/pipeline-json.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,7 @@ processors:
field: message
target_field: event.original
ignore_failure: true
if: ctx.event?.original == null
- json:
field: event.original
target_field: json
Expand Down
1 change: 1 addition & 0 deletions x-pack/filebeat/module/iptables/log/ingest/pipeline.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,6 +54,7 @@ processors:
- rename:
field: message
target_field: event.original
if: ctx.event?.original == null
- grok:
field: iptables.ubiquiti.rule_set
ignore_missing: true
Expand Down
1 change: 1 addition & 0 deletions x-pack/filebeat/module/panw/panos/ingest/pipeline.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,7 @@ processors:
field: message
target_field: event.original
ignore_failure: true
if: ctx.event?.original == null

# Get the timezone from the IETF header if present. Otherwise the timezone
# value added by the add_locale processor will be used.
Expand Down
1 change: 1 addition & 0 deletions x-pack/filebeat/module/threatintel/abusemalware/ingest/pipeline.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,7 @@ processors:
field: message
target_field: event.original
ignore_missing: true
if: ctx.event?.original == null
- json:
field: event.original
target_field: abusech.malware
Expand Down
1 change: 1 addition & 0 deletions x-pack/filebeat/module/threatintel/abuseurl/ingest/pipeline.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,7 @@ processors:
field: message
target_field: event.original
ignore_missing: true
if: ctx.event?.original == null
- json:
field: event.original
target_field: abusech.url
Expand Down
1 change: 1 addition & 0 deletions x-pack/filebeat/module/threatintel/anomali/ingest/pipeline.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,7 @@ processors:
field: message
target_field: event.original
ignore_missing: true
if: ctx.event?.original == null
- json:
field: event.original
target_field: anomali.limo
Expand Down
1 change: 1 addition & 0 deletions x-pack/filebeat/module/threatintel/malwarebazaar/ingest/pipeline.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,7 @@ processors:
field: message
target_field: event.original
ignore_missing: true
if: ctx.event?.original == null
- json:
field: event.original
target_field: abusech.malwarebazaar
Expand Down
1 change: 1 addition & 0 deletions x-pack/filebeat/module/threatintel/misp/ingest/pipeline.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,7 @@ processors:
field: message
target_field: event.original
ignore_missing: true
if: ctx.event?.original == null
- json:
field: event.original
target_field: json
Expand Down
1 change: 1 addition & 0 deletions x-pack/filebeat/module/threatintel/otx/ingest/pipeline.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,7 @@ processors:
field: message
target_field: event.original
ignore_missing: true
if: ctx.event?.original == null
- json:
field: event.original
target_field: otx
Expand Down
1 change: 1 addition & 0 deletions x-pack/filebeat/module/threatintel/threatq/ingest/pipeline.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,7 @@ processors:
field: message
target_field: event.original
ignore_missing: true
if: ctx.event?.original == null
- json:
field: event.original
target_field: json
Expand Down
Loading